Re: [PATCH] net: make sure final 'struct net' free in net_complete_free() is always deferred

On 2026/08/17 14:26, Eric Dumazet wrote:

On Mon, Aug 17, 2026 at 6:28 AM Kuniyuki Iwashima [off-list ref] wrote:

quoted

On Sun, Aug 16, 2026 at 4:08 AM Tetsuo Handa
[off-list ref] wrote:

quoted

Since there is no serialization mechanism (e.g. the RTNL lock) between
llist_add() in net_complete_free() and llist_del_all() in
net_complete_free(), it is possible that net_complete_free() finds 'struct
net' as soon as net_complete_free() added it to the defer_free_list.

Did you see a real issue or is this based on AI report ?

This is a theoretical issue which I noticed while writing
"[PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()".

quoted

netns_wq is single thread workqueue.

There was a typo.

  Since there is no serialization mechanism (e.g. the RTNL lock) between
  llist_add() in *net_passive_dec()* and llist_del_all() in
  net_complete_free(), it is possible that net_complete_free() finds 'struct
  net' as soon as *net_passive_dec()* added it to the defer_free_list.

Old kernels called net_passive_dec() from only netns_wq context, but
new kernels call net_passive_dec() from not only netns_wq context
but also other contexts, don't they?

Indeed, this patch is not needed.

pw-bot: reject

Sashiko did a correct review (despite the typo above) and is reporting a pre-existing issue at
https://sashiko.dev/#/patchset/34f44e8a-9fa4-4cb3-822e-5db54fb6df44%40I-love.SAKURA.ne.jp .