On Tue, Sep 5, 2023 at 1:52 PM Hillf Danton [off-list ref] wrote:

On Mon, 4 Sep 2023 13:29:57 +0200 Eric Dumazet [off-list ref]

quoted

On Sun, Sep 3, 2023 at 5:57=E2=80=AFAM Hillf Danton [off-list ref]

quoted

On Thu, 31 Aug 2023 15:12:30 +0200 Eric Dumazet [off-list ref]

quoted

--- a/net/core/dst.c
+++ b/net/core/dst.c

@@ -163,8 +163,13 @@ EXPORT_SYMBOL(dst_dev_put);

 void dst_release(struct dst_entry *dst)
 {
-       if (dst && rcuref_put(&dst->__rcuref))
+       if (dst && rcuref_put(&dst->__rcuref)) {
+               if (!(dst->flags & DST_NOCOUNT)) {
+                       dst->flags |= DST_NOCOUNT;
+                       dst_entries_add(dst->ops, -1);

Could this add happen after the rcu sync above?

I do not think so. All dst_release() should happen before netns removal.

        cpu2                    cpu3
        ====                    ====
        cleanup_net()           __sys_sendto
                                sock_sendmsg()
                                udpv6_sendmsg()
        synchronize_rcu();
                                dst_release()

Could this one be an exception?

No idea what you are trying to say.

Please give exact locations, instead of being rather vague.

Note that an UDP socket can not send a packet while its netns is dismantled,
because alive sockets keep a reference on the netns.