Re: [PATCH] net: make sure final 'struct net' free in net_complete_free() is always deferred

On Sun, Aug 16, 2026 at 4:08 AM Tetsuo Handa
<[email protected]> wrote:
>
> Since there is no serialization mechanism (e.g. the RTNL lock) between
> llist_add() in net_complete_free() and llist_del_all() in
> net_complete_free(), it is possible that net_complete_free() finds 'struct
> net' as soon as net_complete_free() added it to the defer_free_list.

Did you see a real issue or is this based on AI report ?

netns_wq is single thread workqueue.


>
> Fixes: 0f6ede9fbc74 ("net: defer final 'struct net' free in netns dismantle")
> Signed-off-by: Tetsuo Handa <[email protected]>
> ---
>  net/core/net_namespace.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index d9dafe24f57e..6e9a0c29a9a0 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -514,14 +514,10 @@ static struct net *net_alloc(void)
>
>  static LLIST_HEAD(defer_free_list);
>
> -static void net_complete_free(void)
> +static void net_complete_free(struct llist_node *kill_list)
>  {
> -       struct llist_node *kill_list;
>         struct net *net, *next;
>
> -       /* Get the list of namespaces to free from last round. */
> -       kill_list = llist_del_all(&defer_free_list);
> -
>         llist_for_each_entry_safe(net, next, kill_list, defer_free_list)
>                 kmem_cache_free(net_cachep, net);
>
> @@ -703,12 +699,15 @@ static void cleanup_net(struct work_struct *work)
>
>         up_read(&pernet_ops_rwsem);
>
> +       /* Get the list of namespaces to free from last round. */
> +       net_kill_list = llist_del_all(&defer_free_list);
> +
>         /* Ensure there are no outstanding rcu callbacks using this
>          * network namespace.
>          */
>         rcu_barrier();
>
> -       net_complete_free();
> +       net_complete_free(net_kill_list);
>
>         /* Finally it is safe to free my network namespace structure */
>         list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
> --
> 2.55.0
>