Re: [PATCH net v4] net: pin protocol module before inet socket allocation

[Chengfeng Ye]

Hi Kuniyuki

On Tue, Oct 13, 2026 at 4:07 AM Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> wrote:
>
> From: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
> Date: Sat,  3 Oct 2026 01:38:44 +0800
> > inet_create() and inet6_create() look up the protocol under RCU, then drop
> > RCU before using the resulting proto. A concurrent module unload can
> > unregister the protosw, wait for the RCU readers, and destroy the proto's
> > slab before sk_alloc() uses it. sk_alloc() may sleep, so the RCU read-side
> > critical section cannot simply be extended across the allocation.
> >
> > The reported failure occurred during concurrent L2TP socket creation and
> > module unload:
> >
> >   Oops: general protection fault, probably for non-canonical address
> >         0xffff1108974182a0
> >   KASAN: maybe wild-memory-access in range
> >          [0xfff8a844ba0c1500-0xfff8a844ba0c1507]
> >   RIP: kmem_cache_alloc_noprof+0x63/0x370
> >   Call Trace:
> >    sk_prot_alloc+0x74/0x2c0
> >    sk_alloc+0x2b/0x6c0
> >    inet_create+0x2cd/0xd40
> >    __sock_create+0x1c3/0x430
> >    __sys_socket+0x116/0x1d0
> >
> > Cache the proto and its owner under RCU and acquire a temporary module
> > reference before dropping RCU. This prevents normal module unload while
> > the proto is in use. sk_prot_alloc() takes the socket's own reference;
> > drop the temporary reference on every exit after allocation. Use the
> > cached proto for the IPv6 backlog callback as well.
> >
> > Use try_module_get() with its existing initialization semantics. SCTP
> > creates its kernel control socket during module initialization, so
> > rejecting MODULE_STATE_COMING would prevent modular SCTP from loading.
> > Failed module initialization can still unwind published protocols despite
> > module references; that separate publication/unwind lifetime issue is not
> > fixed here.
> >
> > Fixes: a79af59efd20 ("[NET]: Fix module reference counts for loadable protocol modules")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: GPT-6-Astra
> > Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
> > ---
> > Changes in v4:
> > - Remove the MODULE_STATE_COMING rejection. SCTP creates its kernel control
> >   socket from module init and must be allowed to use the published protosw.
>
> You can filter the case by @kern.
>
> sockets created from __init_net functions always have
> @kern=true otherwise we cannot tear down netns.
>

Thanks for the review and suggestion, v5 adds that @kern checking and
adds back the STATE_COMING rejection in v3

https://lore.kernel.org/netdev/20261013075604.868273-1-nicoyip.dev@xxxxxxxxx/T/#u

Best regards,
Chengfeng