From: Florian Westphal <fw@strlen.de>
Date: Wed, 22 Jul 2026 10:27:48 +0000 (+0200)
Subject: rhashtable: fix false-positive lockdep splat on rhltable destruction
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1132c38927886259c694f77cd74fc577c2216eeb;p=thirdparty%2Flinux.git

rhashtable: fix false-positive lockdep splat on rhltable destruction

Blamed commit removed ht->mutex usage during destruction but forgot to
switch rhashtable_free_one() to rcu_dereference_raw(), this triggers a
lockdep splat when an rhltable gets zapped.

Fixes: 09ae540e1d5c ("rhashtable: drop ht->mutex in rhashtable_free_and_destroy()")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index d459bef245f4..8b2c405e7a66 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -1261,7 +1261,7 @@ static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj,
 	list = container_of(obj, struct rhlist_head, rhead);
 	do {
 		obj = &list->rhead;
-		list = rht_dereference(list->next, ht);
+		list = rcu_dereference_raw(list->next);
 		free_fn(rht_obj(ht, obj), arg);
 	} while (list);
 }