Phil Sutter <phil@xxxxxx> wrote: > So it is possible that ops are still used somewhere after > nf_unregister_net_hook() returns? I don't quite get that code, with all > the RCU-bells and ONCE-whistles. Not ops, but other core could still run the hookfn that is being unregistered, i.e.: cpu 0 unreg hookfn nf_hook_slow runs hookfn if nf_hook() fetched the hook blob (struct nf_hook_entries *) before unreg path called its rcu_assign_pointer with the updated incarnation. That said, this might be a special case as entire nf_hook_entries blob is tied to device that is going down, so packet flow might have stopped already.