Hi Florian, On Tue, 26 Sep 2017, Florian Westphal wrote: > Removing the ipset module leaves a small window where one cpu performs > module removal while another runs a command like 'ipset flush'. > > ipset uses net_generic(), unregistering the pernet ops frees this > storage area. > > Fix it by first removing the user-visible api handlers and the pernet > ops last. > > Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset") > Reported-by: Li Shuang <shuali@xxxxxxxxxx> > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > net/netfilter/ipset/ip_set_core.c | 23 +++++++++++++---------- > 1 file changed, 13 insertions(+), 10 deletions(-) > > diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c > index e495b5e484b1..5ec7740c2088 100644 > --- a/net/netfilter/ipset/ip_set_core.c > +++ b/net/netfilter/ipset/ip_set_core.c > @@ -2072,25 +2072,27 @@ static struct pernet_operations ip_set_net_ops = { > static int __init > ip_set_init(void) > { > - int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys); > + int ret = register_pernet_subsys(&ip_set_net_ops); > + if (ret) { > + pr_err("ip_set: cannot register pernet_subsys.\n"); > + return ret; > + } > > + ret = nfnetlink_subsys_register(&ip_set_netlink_subsys); > if (ret != 0) { > pr_err("ip_set: cannot register with nfnetlink.\n"); > + unregister_pernet_subsys(&ip_set_net_ops); > return ret; > } > + > ret = nf_register_sockopt(&so_set); > if (ret != 0) { > pr_err("SO_SET registry failed: %d\n", ret); > nfnetlink_subsys_unregister(&ip_set_netlink_subsys); > + unregister_pernet_subsys(&ip_set_net_ops); > return ret; > } > - ret = register_pernet_subsys(&ip_set_net_ops); > - if (ret) { > - pr_err("ip_set: cannot register pernet_subsys.\n"); > - nf_unregister_sockopt(&so_set); > - nfnetlink_subsys_unregister(&ip_set_netlink_subsys); > - return ret; > - } > + > pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL); > return 0; > } > @@ -2098,9 +2100,10 @@ ip_set_init(void) > static void __exit > ip_set_fini(void) > { > - unregister_pernet_subsys(&ip_set_net_ops); > - nf_unregister_sockopt(&so_set); > nfnetlink_subsys_unregister(&ip_set_netlink_subsys); > + nf_unregister_sockopt(&so_set); > + > + unregister_pernet_subsys(&ip_set_net_ops); > pr_debug("these are the famous last words\n"); > } Following the registration sequence in backward order, shouldn't first the sockopt, then the netlink_subsys be unregistered? Even if it doesn't matter, I think it'd be more consistent. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html