Re: [PATCH 2/2] rust: revocable: fix race between concurrent revokers

[Boqun Feng <boqun@kernel.org>]

On Thu, Jun 18, 2026 at 09:32:59PM +0200, Danilo Krummrich wrote:
> There is a potential race condition when two paths try to revoke a
> Revocable concurrently.
> 
> It can happen with e.g. Devres, where the driver core's
> devres_release_all() calls Revocable::revoke() via the devres callback,
> while Devres::drop() calls revoke_nosync() on another CPU.
> 
> The revoker that does not claim the is_available swap returns
> immediately, but the revoker that did may still be executing
> drop_in_place() on the inner data. This can cause a use-after-free when
> the other revoker's caller proceeds to drop adjacent resources that
> drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with
> SGTable freeing the backing sg_table and pages).
> 
> Fix this by adding a Completion to Revocable. The revoker that claims
> the swap signals the Completion after drop_in_place() finishes, and any
> concurrent revoker waits for it before returning. This ensures the
> wrapped object is fully torn down before either path continues.
> 

I'm not sure this issue is a Revocable issue or even Devres issue,
because normally if you have a

struct Foo {
    revoke: Revocable<T>
    data: U
}

and if `revoke` referenced `data`, then `T` will have a refcount on `U`
(of course this requires `U` to be a `Arc` or `ARef`, not very
effecient, but correct). And we won't have this issue because either
revoker will be responsible for the finally drop.

This issue happens particularly when we want to save the extra refcount
(and indirect reference), and I think this is the issue that `Foo`
should handle instead of `Revocable`. So maybe we should move the fix
into `Devres` layer? Thoughts?

(I'm still hoping there could be some lightweight usage of Revocable
other than Devres, hence the ask.)

Regards,
Boqun

> If needed, a revoke_no_wait() variant that does not wait for concurrent
> revocations to complete can be added in the future.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/dri-devel/20260612202841.2577C1F000E9@smtp.kernel.org/
> Suggested-by: Gary Guo <gary@garyguo.net>
> Fixes: 05aa6fb1c21d ("rust: scatterlist: Add abstraction for sg_table")
> Signed-off-by: Danilo Krummrich <dakr@kernel.org>
> ---
[...]