On Mon, Jul 6, 2026 at 7:16 PM Daniel Zahka [off-list ref] wrote:

On 7/3/26 7:24 AM, Kiran Kella wrote:

quoted

The race occurs between network namespace removal and PSP device
unregistration.  When a netns is deleted while a PSP device associated
with that netns is concurrently being removed, psp_dev_unregister()

Thanks. I was able to repro myself by inserting a delay after the old:

main_net = dev_net(psd->main_netdev);

and then executing nsim_psp_rereg_write() in parallel with destroying
the netns that I placed a netdevsim dev into.

Tested-by: Daniel Zahka <daniel.zahka@gmail.com>

Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>

Thanks Daniel for reviewing and validating the fix.

quoted

---
  net/psp/psp_nl.c | 33 +++++++++++++++++++++------------
  1 file changed, 21 insertions(+), 12 deletions(-)

quoted

+             ntf = build_ntf(psd, net, ctx);
+             if (ntf)
+                     genlmsg_multicast_netns(&psp_nl_family, net, ntf, 0,
+                                             group, GFP_KERNEL);
+             put_net(net);
      }

some optional nits if you wanted to respin:

You could eliminate the extra struct net *net, by just doing something
like if (!maybe_get_net(assoc_net)) directly.

You could get away with a single put_net(net); call site, if you reorder
the ops that could fail so that maybe_get_net(assoc_net) happens last
before the build_ntf(psd, net, ctx)

ACK. Will fix in v2.
Thanks,
Kiran

quoted

      xa_destroy(&sent_nets);