[PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[Leon Romanovsky]

ib_core, mlx5_ib, and ib_ipoib use call_rcu() with callbacks implemented by
their modules. Stopping callback producers does not drain callbacks already
queued. If module unload completes first, RCU can later invoke code that has
been unloaded. synchronize_rcu() and SRCU waits do not wait for queued
callbacks.

IPoIB reclamation completions are signaled from inside the callbacks, so
they can wake teardown before a callback returns. Initialization unwind
also needs protection because registration can attach existing devices and
undo their setup on failure.

Wait for queued callbacks after all producers have stopped.

Reported-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@xxxxxxxxxxxxx/
Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
---
Leon Romanovsky (3):
      RDMA/core: Wait for RCU callbacks before unloading ib_core
      RDMA/mlx5: Drain RCU callbacks during module teardown
      RDMA/ipoib: Drain RCU callbacks during module teardown

 drivers/infiniband/core/device.c          | 1 +
 drivers/infiniband/hw/mlx5/main.c         | 2 ++
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++
 3 files changed, 5 insertions(+)
---
base-commit: 5f9576c6734abca88a02db72c466e09d2eddf160
change-id: 20260709-unload-rcu-67c6de79b589

Best regards,
--  
Leon Romanovsky <leonro@xxxxxxxxxx>