Re: [PATCH net v2] psp: fix NULL genl_sock deref race with concurrent netns teardown
From: Wei Wang <hidden>
Date: 2026-07-07 19:50:38
Also in:
lkml
On Tue, Jul 7, 2026 at 12:00 PM Kiran Kella [off-list ref] wrote:
quoted
The race occurs between network namespace removal and PSP device unregistration. When a netns is deleted while a PSP device associated with that netns is concurrently being removed, psp_dev_unregister() triggers psp_nl_notify_dev() to send a device change notification. Concurrently, cleanup_net() running in the netns workqueue calls genl_pernet_exit(), which sets net->genl_sock to NULL. If genl_pernet_exit() wins the race, two sites in psp_nl_multicast_per_ns() then dereference the NULL socket and crash: CPU 0 (netns teardown) CPU 1 (PSP device unregister) ====================== ============================= cleanup_net [workqueue] genl_pernet_exit() psp_dev_unregister() net->genl_sock = NULL psp_nl_notify_dev() psp_nl_multicast_per_ns() build_ntf() -> netlink_has_listeners(NULL) /* crash */ genlmsg_multicast_netns() -> nlmsg_multicast_filtered(NULL) /* crash */ Both the main_net path (derived from psd->main_netdev) and each assoc_net entry in psd->assoc_dev_list are affected. Fix by replacing the bare dev_net() calls with maybe_get_net(). maybe_get_net() returns NULL if the namespace is already dying. Holding the reference ensures genl_sock remains valid across both the build_ntf() and genlmsg_multicast_netns() calls. Fixes: 00c94ca2b99e ("psp: base PSP device support") Fixes: 06c2dce2d0f6 ("psp: add new netlink cmd for dev-assoc and dev-disassoc") Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Bhargava Marreddy <redacted> Reviewed-by: Akhilesh Samineni <redacted> Reviewed-by: Daniel Zahka <redacted> Tested-by: Daniel Zahka <redacted> Signed-off-by: Kiran Kella <redacted> --- v2: - get rid of the extra struct net *net, by doing (!maybe_get_net(assoc_net)) directly (as suggested by Daniel Zahka) v1: https://lore.kernel.org/all/20260703112431.2860506-1-kiran.kella@broadcom.com/ (local)
LGTM! Thanks for the fix! Reviewed-by: Wei Wang <redacted>
quoted hunk ↗ jump to hunk
net/psp/psp_nl.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)diff --git a/net/psp/psp_nl.c b/net/psp/psp_nl.c index 9610d8c456ff..1438dbb07949 100644 --- a/net/psp/psp_nl.c +++ b/net/psp/psp_nl.c@@ -62,7 +62,10 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group, struct net *main_net; struct sk_buff *ntf; - main_net = dev_net(psd->main_netdev); + main_net = maybe_get_net(dev_net(psd->main_netdev)); + if (!main_net) + return; + xa_init(&sent_nets); list_for_each_entry(entry, &psd->assoc_dev_list, dev_list) {@@ -77,21 +80,23 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group, if (ret == -EBUSY) continue; - ntf = build_ntf(psd, assoc_net, ctx); - if (!ntf) + if (!maybe_get_net(assoc_net)) continue; - genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf, 0, - group, GFP_KERNEL); + ntf = build_ntf(psd, assoc_net, ctx); + if (ntf) + genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf, + 0, group, GFP_KERNEL); + put_net(assoc_net); } xa_destroy(&sent_nets); /* Send to main device netns */ ntf = build_ntf(psd, main_net, ctx); - if (!ntf) - return; - genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group, - GFP_KERNEL); + if (ntf) + genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group, + GFP_KERNEL); + put_net(main_net); } static struct sk_buff *psp_nl_clone_ntf(struct psp_dev *psd, struct net *net, --2.54.0