Re: [PATCH net] net: hsr: wait for pending node-free RCU callbacks on module exit

[Ali Ahmet Memis]

Please drop the Cc: stable from this one if you take it, and I would
rather the changelog was read as hardening than as a fix for something
observed. I overstated it.

Going back over the exit path: hsr_dellink() deletes the four timers with
timer_delete_sync() and then queues every call_rcu(hsr_free_node_rcu)
from hsr_del_self_node() and hsr_del_nodes(), all under rtnl. The
rtnl_unlock() at the end of rtnl_link_unregister() runs netdev_run_todo(),
which does

	/* Wait for rcu callbacks to finish before next phase */
	if (!list_empty(&list))
		rcu_barrier();

so the callbacks queued during teardown are already waited for before
hsr_netlink_exit() returns. netdev_wait_allrefs_any() calls rcu_barrier()
as well. I do not have a case where a callback survives that.

I still think the barrier belongs there. Documentation/RCU/checklist.rst
asks a module that registers call_rcu() callbacks to rcu_barrier() before
it is unloaded, and net/8021q/vlan.c, net/sctp/protocol.c and net/ipv6/sit.c
all do exactly this in their exit paths, vlan being the same shape as hsr,
an rtnl_link_ops module torn down through rtnl_link_unregister(). It costs
nothing at module unload and does not depend on netdev_run_todo() keeping
that barrier.

But that is defence in depth, not a bug I can point at, so it does not
meet the stable rules. Happy to resend with the changelog rewritten that
way, or to drop it entirely if you would rather not carry it.

--
Ali