Re: [RFC PATCH 1/2] RDMA/rxe: drive UDP tunnel socket lifetime from the GID table

[Jason Gunthorpe]

On Sun, Jul 19, 2026 at 08:54:47PM +0300, Serhat Kumral wrote:
> > Don't get this, GID removal is asynchronous, so it will eventually
> > complete, what is wrong with leaving the socks around but unsuable for
> > a little bit? Does something break?
> 
> I checked this more closely. You are right that a kernel socket's
> passive net reference keeps struct net itself allocated, so my
> wording about closing the sockets before the net is freed was
> inaccurate.
> 
> However, the passive reference does not defer the pernet exit
> callbacks. cleanup_net runs those callbacks before dropping its base
> passive reference. With CONFIG_PROC_FS, sock_inuse_exit_net() frees
> net->core.prot_inuse; when per-netns UDP hash tables are enabled,
> udp_pernet_table_free() also frees net->ipv4.udp_table. The eventual
> udp_tunnel_sock_release() reaches udp_lib_unhash(), which accesses
> this state while unhashing a still-hashed socket. A sufficiently
> delayed close can therefore access freed pernet storage even though
> struct net itself remains allocated.

I'm skeptical this AI conclusion is right? Or at least a leaking sock
crashing the kernel sounds like a netdev bug, not something to avoid here.

Jason