[PATCH net v1 0/4] net: devmem: fix RX and TX binding teardown on device unregistration

From: Mina Almasry

Date: Fri Oct 09 2026 - 22:55:47 EST


Fix two device-unregistration lifecycle bugs in devmem TCP bindings and
add netdevsim support plus selftests covering both RX and TX device
unregistration:

1. net: devmem: unmap dma_buf synchronously on queue uninstall
Synchronously unmap and detach binding->attachment under binding->lock
when the last RX queue is uninstalled in mp_dmabuf_devmem_uninstall(),
preventing slab-use-after-free in dma_unmap_sg_attrs() when the netlink
socket closes after dma_dev is freed.

2. net: devmem: detach TX bindings on NETDEV_UNREGISTER
Add net_devmem_dev_unregister() on NETDEV_UNREGISTER to fully detach and
unmap TX bindings when binding->dev unregisters, or clear binding->vdev
alone when only a virtual device unregisters while binding->dev lives.

3. netdevsim: support devmem RX and TX bindings
Enable PP_FLAG_DMA_MAP | PP_FLAG_ALLOW_UNREADABLE_NETMEM, 64-bit DMA mask
on nsim_bus_dev, and NETMEM_TX_DMA on netdevsim so devmem RX/TX bindings
can be exercised in software selftests.

4. selftests: net: add devmem RX and TX netdev unregister tests
Add devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check
to tools/testing/selftests/net/nl_netdev.py.

Cc: Tariq Toukan <tariqt@xxxxxxxxxx>
Cc: Kaifeng Wang <kaifengw@xxxxxxxxxx>

Mina Almasry (4):
net: devmem: unmap dma_buf synchronously on queue uninstall
net: devmem: detach TX bindings on NETDEV_UNREGISTER
netdevsim: support devmem RX and TX bindings
selftests: net: add devmem RX and TX netdev unregister tests

drivers/net/netdevsim/bus.c | 1 +
drivers/net/netdevsim/netdev.c | 21 +++--
net/core/devmem.c | 68 +++++++++++++-
net/core/devmem.h | 5 ++
net/core/netdev-genl.c | 1 +
tools/testing/selftests/net/nl_netdev.py | 108 ++++++++++++++++++++++-
6 files changed, 192 insertions(+), 12 deletions(-)


base-commit: af32da41b0327b9c6a37856ba82b6760d6c8d10e
--
2.56.0.385.gd3acb90ef8-goog