Thread (5 messages) 5 messages, 2 authors, 2026-01-22

Re: [net-next,1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-01-22 04:19:39
Also in: lkml

Haven't had the time to think about this TBH but FWIW:

This is an AI-generated review of your patch.
For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
psp: Support for transmit on logical device when the underlying transport
device supports PSP.

This patch propagates psp_dev pointers from lower devices to upper devices
(e.g., VLANs) via a netdevice notifier. Upper devices borrow the pointer
without taking a reference, and the borrowed pointer is cleared when the
link changes.
quoted hunk ↗ jump to hunk
diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index a8534124f626..0bff50c9314d 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -313,10 +313,124 @@ int psp_dev_rcv(struct sk_buff *skb, u16 dev_id, u8 generation, bool strip_icv)
 }
 EXPORT_SYMBOL(psp_dev_rcv);

+/**
+ * psp_netdevice_event() - Handle netdevice events for PSP device propagation
[ ... ]
+ * Propagates psp_dev pointer from lower devices to upper devices when
+ * upper devices are created (e.g., VLAN subinterfaces).
+ */
+static int psp_netdevice_event(struct notifier_block *nb,
+			       unsigned long event, void *ptr)
+{
[ ... ]
+		/* Get psp_dev from the immediate lower device */
+		psd = rcu_dereference(dev->psp_dev);
+		rcu_read_unlock();
+
+		/* Propagate psp_dev to upper device if found */
+		if (psd)
+			rcu_assign_pointer(upper_dev->psp_dev, psd);
The commit message states that borrowed pointers are cleared when the lower
device is "unlinked". However, what happens if psp_dev_unregister() is
called on the lower device without first unlinking the upper devices?

Looking at nsim_psp_rereg_write() in drivers/net/netdevsim/psp.c, it calls
nsim_psp_uninit()->psp_dev_unregister() without unregistering the netdevice.
If there are upper devices (e.g., VLANs) that have borrowed the psp_dev
pointer, would they be left with a dangling pointer after the RCU grace
period completes?

Similarly, nsim_destroy() calls nsim_psp_uninit() before calling
unregister_netdevice(), so the upper devices would still have borrowed
pointers when psp_dev_unregister() frees the psp_dev structure.

Could this lead to use-after-free if an upper device's psp_dev pointer is
accessed after the underlying psp_dev has been freed?

Would it make sense to either:
(a) Document that netdevice must be unregistered before psp_dev_unregister()
    is called, or
(b) Walk the upper device stack in psp_dev_unregister() to clear borrowed
    pointers, or
(c) Update existing callers (netdevsim) to ensure proper ordering?
+	} else {
[ ... ]
+	return NOTIFY_DONE;
+}
-- 
pw-bot: cr
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help