Re: [PATCH] rhashtable: fix false-positive lockdep splat on rhltable destruction

On Wed, Jul 22, 2026 at 3:27 PM Florian Westphal <[email protected]> wrote:
>
> Blamed commit removed ht->mutex usage during destruction but forgot to
> switch rhashtable_free_one() to rcu_dereference_raw(), this triggers a
> lockdep splat when an rhltable gets zapped.
>
> Fixes: 09ae540e1d5c ("rhashtable: drop ht->mutex in rhashtable_free_and_destroy()")
> Signed-off-by: Florian Westphal <[email protected]>
> ---
>  lib/rhashtable.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/rhashtable.c b/lib/rhashtable.c
> index 40cfb38ac919..68de5019abbf 100644
> --- a/lib/rhashtable.c
> +++ b/lib/rhashtable.c
> @@ -1260,7 +1260,7 @@ static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj,
>         list = container_of(obj, struct rhlist_head, rhead);
>         do {
>                 obj = &list->rhead;
> -               list = rht_dereference(list->next, ht);
> +               list = rcu_dereference_raw(list->next);
>                 free_fn(rht_obj(ht, obj), arg);
>         } while (list);
>  }
> --
> 2.54.0
>

Correct, and thanks for catching it. rhashtable_free_one() returns
early for !ht->rhlist, so the simple_xattrs users that motivated
09ae540e1d5c never reach the rht_dereference() -- I missed it when
auditing the teardown path.

I re-checked the remaining dereferences reachable from
rhashtable_free_and_destroy(); this was the last one still requiring
ht->mutex.

Reviewed-by: Mikhail Gavrilov <[email protected]>

-- 
Best Regards,
Mike Gavrilov.