Re: [PATCH] io_uring/napi: fix list use-after-free on PREEMPT_RT

[Steven Rostedt]

On Thu, 29 Oct 2026 08:28:13 -0600
Jens Axboe <axboe@xxxxxxxxx> wrote:

> On 10/29/26 7:48 AM, Steven Rostedt wrote:
> > On Thu, 29 Oct 2026 07:42:09 -0600
> > Jens Axboe <axboe@xxxxxxxxx> wrote:
> >   
> >> I don't think your analysis is fully correct. On PREEMPT_RT, spin_lock()
> >> should still be an RCU read side critical section. __rt_spin_lock()
> >> calls rcu_read_lock() after taking the rtmutex, and then
> >> rt_spin_unlock() drops it at the end. There's even a comment on
> >> kfree_rcu() callbacks in there too, it should not be able to run until
> >> napi_lock is released, which is post the loop.  
> > 
> > Good point.  
> 
> If even the preempt rt people can't get this right, that's a little
> worrying :)

I really didn't even take a deep look at how preempt-rt was involved. I
just didn't like the assumption about the RCU internals in general ;-)

> 
> >> IOW, I think this patch is unnecessary - there's no bug there. The list
> >> safe change could be done as a cleanup, but it's not a fix.  
> > 
> > I agree, it should still be applied, but as a clean up and not a fix.  
> 
> Sure, like I said, as a cleanup. But would need a resend as the
> analysis in the commit message is entirely wrong.
> 

Totally agree.

-- Steve