Re: [PATCH net 1/1] udp: diag: bound bucket lock hold time

[zihan xi]

On Sun, Sep 6, 2026 at 3:29 AM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
>
> On Sat, 5 Sep 2026 23:49:05 +0800 zihan xi wrote:
> > > When an active netlink dump for UDP sockets finishes, inet_diag_dump_done()
> > > invokes udp_diag_dump_done(). This function drops its module reference using
> > > module_put(THIS_MODULE) as its final step.
> > >
> > > If this was the last reference, a concurrent rmmod udp_diag operation can
> > > proceed and unmap the module's text segment before the thread executing
> > > udp_diag_dump_done() executes its return instruction to return to inet_diag.
> > >
> > > Could this result in a kernel panic due to the CPU attempting to execute
> > > unmapped memory?
> >
> > Yes.  If that module_put() drops the last reference, rmmod can unmap
> > udp_diag while dump_done() is still returning to inet_diag.
> >
> > I will keep the extra module_get() in udp_diag_dump(), and move the
> > matching module_put() into inet_diag_dump_done() so it runs after the
> > callback has returned.
> >
> > v2 incoming.
>
> FTR your patch also looks atrociously ugly.
> If you send v2 please make it better.

I'll rework it.  v2 will follow tcp_diag's batching and drop the
socket cursor, dump_done callback, and extra module reference.

Thanks,
Zihan