Daniel Zahka wrote:
> The debugfs write handler, nsim_psp_rereg_write(), can race against
> nsim_destroy() and against itself, causing nsim_psp_uninit() to run
> more than once concurrently. Two complementary changes serialize all
> callers:

nit: sounds and looks as if this would be simpler as two patches.
but no need to respin just for that.

> 
> 1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before
>    doing the actual teardown. debugfs_remove() drains any in-flight
>    writers and prevents new ones from starting.
> 
> 2. Add a mutex around the body of nsim_psp_rereg_write() so that two
>    concurrent userspace writers cannot both enter the teardown path
>    at once.
> 
> The teardown work itself is moved into a new __nsim_psp_uninit() that
> the rereg handler calls under the mutex, while the public
> nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()
> pair so nsim_destroy() doesn't have to know about the psp internals.
> 
> Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>