[PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[Leon Romanovsky]

ib_core, mlx5_ib, and ib_ipoib use call_rcu() with callbacks implemented by
their modules. Stopping callback producers does not drain callbacks already
queued. If module unload completes first, RCU can later invoke code that has
been unloaded. synchronize_rcu() and SRCU waits do not wait for queued
callbacks.

IPoIB reclamation completions are signaled from inside the callbacks, so
they can wake teardown before a callback returns. Initialization unwind
also needs protection because registration can attach existing devices and
undo their setup on failure.

Wait for queued callbacks after all producers have stopped.

Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
Leon Romanovsky (3):
      RDMA/core: Wait for RCU callbacks before unloading ib_core
      RDMA/mlx5: Drain RCU callbacks during module teardown
      RDMA/ipoib: Drain RCU callbacks during module teardown

 drivers/infiniband/core/device.c          | 1 +
 drivers/infiniband/hw/mlx5/main.c         | 2 ++
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++
 3 files changed, 5 insertions(+)
---
base-commit: 5f9576c6734abca88a02db72c466e09d2eddf160
change-id: 20260709-unload-rcu-67c6de79b589

Best regards,
--  
Leon Romanovsky <leonro@nvidia.com>

[PATCH rdma-rc 1/3] RDMA/core: Wait for RCU callbacks before unloading ib_core

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

put_gid_ndev() is queued with call_rcu() and implemented in ib_core.
Stopping the workqueues does not drain callbacks already queued, so RCU
could invoke it after the module code has been unloaded.

synchronize_rcu() does not wait for callbacks. Wait for them after all
producers have stopped.

Fixes: 943bd984b108 ("RDMA/core: Allow detaching gid attribute netdevice for RoCE")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/core/device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index b8193e077a74..d954eda63134 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -3150,6 +3150,7 @@ static void __exit ib_core_cleanup(void)
 	/* Make sure that any pending umem accounting work is done. */
 	destroy_workqueue(ib_wq);
 	destroy_workqueue(ib_unreg_wq);
+	rcu_barrier();
 	WARN_ON(!xa_empty(&clients));
 	WARN_ON(!xa_empty(&devices));
 }

-- 
2.54.0

[PATCH rdma-rc 2/3] RDMA/mlx5: Drain RCU callbacks during module teardown

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

devx_free_subscription() can remain queued after the last DevX event file
drops its module reference or an auxiliary driver detaches its devices.
mlx5_ib can then unload before the callback runs.

Registration error unwind has the same risk because driver registration
can attach existing devices before failing. Wait after all drivers have
stopped.

Fixes: 6898d1c661d7 ("RDMA/mlx5: Use RCU and direct refcounts to keep memory alive")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx5/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 02809114fc79..4ff6cca7e581 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -5538,6 +5538,7 @@ static int __init mlx5_ib_init(void)
 dd_err:
 	mlx5r_rep_cleanup();
 rep_err:
+	rcu_barrier();
 	mlx5_ib_qp_event_cleanup();
 qp_event_err:
 	destroy_workqueue(mlx5_ib_event_wq);
@@ -5551,6 +5552,7 @@ static void __exit mlx5_ib_cleanup(void)
 	auxiliary_driver_unregister(&mlx5r_driver);
 	auxiliary_driver_unregister(&mlx5r_mp_driver);
 	mlx5r_rep_cleanup();
+	rcu_barrier();
 
 	mlx5_ib_qp_event_cleanup();
 	destroy_workqueue(mlx5_ib_event_wq);

-- 
2.54.0

[PATCH rdma-rc 3/3] RDMA/ipoib: Drain RCU callbacks during module teardown

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

IPoIB reclamation completions can be signaled from inside an RCU callback.
Teardown can wake before the callback returns and unload ib_ipoib while its
code is still executing.

Client registration failure can also remove already-added devices and queue
callbacks. Wait after client and workqueue teardown.

Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 16a015b67206..6c14246befb1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2783,6 +2783,7 @@ static int __init ipoib_init_module(void)
 err_sa:
 	ib_sa_unregister_client(&ipoib_sa_client);
 	destroy_workqueue(ipoib_workqueue);
+	rcu_barrier();
 
 err_fs:
 	ipoib_unregister_debugfs();
@@ -2800,6 +2801,7 @@ static void __exit ipoib_cleanup_module(void)
 	ib_sa_unregister_client(&ipoib_sa_client);
 	ipoib_unregister_debugfs();
 	destroy_workqueue(ipoib_workqueue);
+	rcu_barrier();
 }
 
 module_init(ipoib_init_module);

-- 
2.54.0

Re: [PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[Sebastian Andrzej Siewior]

On 2026-07-09 12:06:46 [+0300], Leon Romanovsky wrote:
> ib_core, mlx5_ib, and ib_ipoib use call_rcu() with callbacks implemented by
> their modules. Stopping callback producers does not drain callbacks already
> queued. If module unload completes first, RCU can later invoke code that has
> been unloaded. synchronize_rcu() and SRCU waits do not wait for queued
> callbacks.
> 
> IPoIB reclamation completions are signaled from inside the callbacks, so
> they can wake teardown before a callback returns. Initialization unwind
> also needs protection because registration can attach existing devices and
> undo their setup on failure.
> 
> Wait for queued callbacks after all producers have stopped.
> 
> Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Thank you. This makes sense. drivers/infiniband/hw/hfi1 might need the
same.

However, we do have a little conversation thinking about moving
rcu_barrier() into the module core code but nothing has been decided so
far. I'm trying to figure out how many might be affected by this.

Sebastian

Re: [PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[Leon Romanovsky]

On Thu, Jul 09, 2026 at 11:59:21AM +0200, Sebastian Andrzej Siewior wrote:
> On 2026-07-09 12:06:46 [+0300], Leon Romanovsky wrote:
> > ib_core, mlx5_ib, and ib_ipoib use call_rcu() with callbacks implemented by
> > their modules. Stopping callback producers does not drain callbacks already
> > queued. If module unload completes first, RCU can later invoke code that has
> > been unloaded. synchronize_rcu() and SRCU waits do not wait for queued
> > callbacks.
> > 
> > IPoIB reclamation completions are signaled from inside the callbacks, so
> > they can wake teardown before a callback returns. Initialization unwind
> > also needs protection because registration can attach existing devices and
> > undo their setup on failure.
> > 
> > Wait for queued callbacks after all producers have stopped.
> > 
> > Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> > Closes: https://lore.kernel.org/linux-rdma/20260708092316.Qb39F_B0@linutronix.de/
> > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> 
> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> 
> Thank you. This makes sense. drivers/infiniband/hw/hfi1 might need the
> same.

hfi1 has an rcu_barrier() call in hfi1_free_devdata():
https://elixir.bootlin.com/linux/v7.1.2/source/drivers/infiniband/hw/hfi1/init.c#L1176

Thanks

Re: [PATCH rdma-rc 0/3] RDMA: Prevent RCU callbacks from outliving modules

[Sebastian Andrzej Siewior]

On 2026-07-09 14:05:59 [+0300], Leon Romanovsky wrote:
> hfi1 has an rcu_barrier() call in hfi1_free_devdata():
> https://elixir.bootlin.com/linux/v7.1.2/source/drivers/infiniband/hw/hfi1/init.c#L1176

Indeed. Sorry for the noise.

> Thanks

Sebastian