Re: [PATCH net v1] net: sit: unlink PRL list before RCU free

[Jakub Kicinski]

On Wed, 14 Oct 2026 14:08:03 +0800 Binbin Deng wrote:
> Deleting all PRL entries queues the old list for RCU freeing before
> t->prl is cleared. A reader that enters an RCU critical section after
> call_rcu() but before the pointer is cleared can still fetch the old
> list, and that critical section is not guaranteed to be covered by the
> grace period associated with the callback. RTNL does not prevent this
> race: RCU readers do not acquire it and the writer remains preemptible.
> It can lead to use-after-free.

Eric already fixed this