Re: [PATCH net] net: pin protocol module before socket allocation

[Chengfeng Ye]

On Tue, Aug 25, 2026 at 2:22 AM Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> wrote:
> inet_create() rather looks broken.
>
> inet_unregister_protosw() calls synchronize_net(), but the following
> proto_unregister() might be done after rcu_read_unlock() and before
> WARN_ON(!answer_prot->slab) in inet_create().

Right, that is the root cause. As sk_alloc() uses GFP_KERNEL, it
cannot run under rcu_read_lock(). I just sent a v2 by moving the extra
module reference get/put to inet_create().

> Which module did you use to trigger the bug ?

It is l2tp_ip, via socket(AF_INET, SOCK_DGRAM, IPPROTO_L2TP) racing
delete_module("l2tp_ip"). I think inet6_create() also suffers from
this bug as it has a similar pattern, so v2 also fixes that path as
well.

Best regards,
Chengfeng