[PATCH] rhashtable: fix false-positive lockdep splat on rhltable destruction

[PATCH] rhashtable: fix false-positive lockdep splat on rhltable destruction

[Florian Westphal]

Blamed commit removed ht->mutex usage during destruction but forgot to
switch rhashtable_free_one() to rcu_dereference_raw(), this triggers a
lockdep splat when an rhltable gets zapped.

Fixes: 09ae540e1d5c ("rhashtable: drop ht->mutex in rhashtable_free_and_destroy()")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 lib/rhashtable.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 40cfb38ac919..68de5019abbf 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -1260,7 +1260,7 @@ static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj,
 	list = container_of(obj, struct rhlist_head, rhead);
 	do {
 		obj = &list->rhead;
-		list = rht_dereference(list->next, ht);
+		list = rcu_dereference_raw(list->next);
 		free_fn(rht_obj(ht, obj), arg);
 	} while (list);
 }
-- 
2.54.0

Re: [PATCH] rhashtable: fix false-positive lockdep splat on rhltable destruction

[Mikhail Gavrilov]

On Wed, Jul 22, 2026 at 3:27 PM Florian Westphal <fw@strlen.de> wrote:
>
> Blamed commit removed ht->mutex usage during destruction but forgot to
> switch rhashtable_free_one() to rcu_dereference_raw(), this triggers a
> lockdep splat when an rhltable gets zapped.
>
> Fixes: 09ae540e1d5c ("rhashtable: drop ht->mutex in rhashtable_free_and_destroy()")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  lib/rhashtable.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/rhashtable.c b/lib/rhashtable.c
> index 40cfb38ac919..68de5019abbf 100644
> --- a/lib/rhashtable.c
> +++ b/lib/rhashtable.c
> @@ -1260,7 +1260,7 @@ static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj,
>         list = container_of(obj, struct rhlist_head, rhead);
>         do {
>                 obj = &list->rhead;
> -               list = rht_dereference(list->next, ht);
> +               list = rcu_dereference_raw(list->next);
>                 free_fn(rht_obj(ht, obj), arg);
>         } while (list);
>  }
> --
> 2.54.0
>

Correct, and thanks for catching it. rhashtable_free_one() returns
early for !ht->rhlist, so the simple_xattrs users that motivated
09ae540e1d5c never reach the rht_dereference() -- I missed it when
auditing the teardown path.

I re-checked the remaining dereferences reachable from
rhashtable_free_and_destroy(); this was the last one still requiring
ht->mutex.

Reviewed-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>

-- 
Best Regards,
Mike Gavrilov.