On Tue, Jul 08, 2025 at 04:44:50PM -0700, Martin KaFai Lau wrote: > On 7/7/25 8:51 AM, Jordan Rife wrote: > > +static void remove_seen_established(int family, int sock_type, const char *addr, > > + __u16 port, int *listen_socks, > > + int listen_socks_len, int *established_socks, > > + int established_socks_len, > > + struct sock_count *counts, int counts_len, > > + struct bpf_link *link, int iter_fd) > > +{ > > + int close_idx; > > + > > + /* Iterate through all listening sockets. */ > > + read_n(iter_fd, listen_socks_len, counts, counts_len); > > + > > + /* Make sure we saw all listening sockets exactly once. */ > > + check_n_were_seen_once(listen_socks, listen_socks_len, listen_socks_len, > > + counts, counts_len); > > + > > + /* Leave one established socket. */ > > + read_n(iter_fd, established_socks_len - 1, counts, counts_len); > > + > > + /* Close a socket we've already seen to remove it from the bucket. */ > > + close_idx = get_nth_socket(established_socks, established_socks_len, > > + link, listen_socks_len + 1); > > + if (!ASSERT_GE(close_idx, 0, "close_idx")) > > + return; > > + destroy(established_socks[close_idx]); > > + established_socks[close_idx] = -1; > > I may have missed where the fd is closed, > does it need to be close() first before assigning -1? Oops, forgot to do the close after I replaced these calls with destroy. I'll add a call to close(fd) at the end of destroy in the next spin. Jordan