[PATCH] configfs: wait for pending RCU callbacks on module exit

[PATCH] configfs: wait for pending RCU callbacks on module exit

[Yuichiro Goto]

configfs inodes are freed from an RCU callback: destroy_inode() queues
i_callback() with call_rcu(), and i_callback() then calls the
->free_inode() of the super block, configfs_free_inode(). Nothing in
configfs_exit() waits for these callbacks, so the module can go away
while some of them are still pending, and they later jump into freed
module text.

USB gadget hits this easily. libcomposite pins configfs with
simple_pin_fs() when it registers its subsystem and drops the internal
mount on unregister, which frees the root inode. Unloading the modules
right after that, e.g.

  modprobe usb_f_rndis
  modprobe -r usb_f_rndis

oopses a few seconds later with CONFIG_RCU_LAZY=y, which batches
call_rcu() callbacks for up to 10 seconds:

  Unable to handle kernel paging request at virtual address bf17e810 when execute
  Internal error: Oops: 80000007 [#1] SMP ARM
  Modules linked in: ... [last unloaded: configfs]
  CPU: 0 UID: 0 PID: 16 Comm: rcuos/0 Not tainted 6.18.63 #4 VOLUNTARY
  Hardware name: Freescale i.MX6 Ultralite (Device Tree)
  PC is at 0xbf17e810
  LR is at rcu_do_batch+0x190/0x510
  ...
  Call trace:
   rcu_do_batch from rcu_nocb_cb_kthread+0xc8/0x310
   rcu_nocb_cb_kthread from kthread+0xe8/0x248
   kthread from ret_from_fork+0x14/0x28

RCU_LAZY only widens the window. The same oops also happens on a
v5.4-based kernel, which has no RCU_LAZY, with the same two commands.

Call rcu_barrier() in configfs_exit() once the file system is
unregistered, so that no new inodes can be created and all pending
configfs_free_inode() calls have finished before the module is freed.

Fixes: e9c03af21cc7 ("configfs: calculate the symlink target only once")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yuichiro Goto <goto@k-tech.co.jp>
---
 fs/configfs/mount.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index d8cac1cbf3bd..c65d8ff419b2 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -164,6 +164,8 @@ static void __exit configfs_exit(void)
 {
 	unregister_filesystem(&configfs_fs_type);
 	sysfs_remove_mount_point(kernel_kobj, "config");
+	/* Pending RCU callbacks may still call configfs_free_inode() */
+	rcu_barrier();
 	kmem_cache_destroy(configfs_dir_cachep);
 	configfs_dir_cachep = NULL;
 }
-- 
2.47.3

Re: [PATCH] configfs: wait for pending RCU callbacks on module exit

[Breno Leitao]

On Fri, Nov 13, 2026 at 12:38:33PM +0900, Yuichiro Goto wrote:
> configfs inodes are freed from an RCU callback: destroy_inode() queues
> i_callback() with call_rcu(), and i_callback() then calls the
> ->free_inode() of the super block, configfs_free_inode(). Nothing in
> configfs_exit() waits for these callbacks, so the module can go away
> while some of them are still pending, and they later jump into freed
> module text.

Is this still the case on mainline? Since commit 3bc999d944b3 ("mm/slab:
introduce kfree_rcu_nolock()") in v7.3, kmem_cache_destroy() calls
rcu_barrier() unconditionally, and configfs_exit() already reaches it:

configfs_exit()
	kmem_cache_destroy(configfs_dir_cachep)
		kvfree_rcu_barrier_on_cache()
			rcu_barrier()

so the pending configfs_free_inode() calls finish before configfs_exit()
returns.