On Thu, 23 Nov 2023 at 17:32, Eric Dumazet <edumazet@xxxxxxxxxx> wrote: > > On Thu, Nov 23, 2023 at 3:34 PM Valentin Schneider <vschneid@xxxxxxxxxx> wrote: > > I thought that was already the case, per inet_twsk_hashdance(): > > > > /* tw_refcnt is set to 3 because we have : > > * - one reference for bhash chain. > > * - one reference for ehash chain. > > * - one reference for timer. > > > > and > > > > tw_timer_handler() > > `\ > > inet_twsk_kill() > > `\ > > inet_twsk_put() > > > > So AFAICT, after we go through the hashdance, there's a reference on > > tw_refcnt held by the tw_timer. > > inet_twsk_deschedule_put() can race with arming the timer, but it only > > calls inet_twsk_kill() if the timer > > was already armed & has been deleted, so there's no risk of calling it > > twice... If I got it right :-) > > > > Again, I think you missed some details. > > I am OOO for a few days, I do not have time to elaborate. > > You will need to properly track active timer by elevating > tw->tw_refcnt, or I guarantee something wrong will happen. > Gotcha, let me dig into this then!
