Re: [PATCH net 1/4] drop_monitor: synchronize tracepoint unregistration on error path

[Hangbin Liu <hangbin.liu@linux.dev>]

On Thu, Sep 10, 2026 at 08:46:09PM +0000, Eric Dumazet wrote:
> If register_trace_napi_poll() fails in net_dm_trace_on_set(),
> unregister_trace_kfree_skb() is called to roll back the kfree_skb
> tracepoint registration.
> 
> However, tracepoint_synchronize_unregister() is omitted before calling
> cancel_work_sync() and module_put(). An in-flight probe executing
> concurrently on another CPU could call schedule_work() after
> cancel_work_sync() has already returned, leaving a pending work item
> scheduled after the module reference is dropped. If the module is then
> unloaded, executing the work item triggers a kernel panic.
> 
> Add tracepoint_synchronize_unregister() after unregister_trace_kfree_skb()
> in the error path, matching net_dm_trace_off_set() and
> net_dm_hw_probe_unregister().
> 
> Fixes: 7c747838a558 ("drop_monitor: Split tracing enable / disable to different functions")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/core/drop_monitor.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
> index abaf108ac4db8c762c23f1d9c708c687ee36c7c9..018d19e3a71de0be50bcc5753ba65f715f678aaa 100644
> --- a/net/core/drop_monitor.c
> +++ b/net/core/drop_monitor.c
> @@ -1173,6 +1173,7 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack)
>  
>  err_unregister_trace:
>  	unregister_trace_kfree_skb(ops->kfree_skb_probe, NULL);
> +	tracepoint_synchronize_unregister();
>  err_module_put:
>  	for_each_possible_cpu(cpu) {
>  		struct per_cpu_dm_data *data = &per_cpu(dm_cpu_data, cpu);
> -- 
> 2.55.0.1007.g17ff1f9808-goog
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>