Re: [PATCH] configfs: wait for pending RCU callbacks on module exit

[Breno Leitao <leitao@debian.org>]

On Fri, Nov 13, 2026 at 12:38:33PM +0900, Yuichiro Goto wrote:
> configfs inodes are freed from an RCU callback: destroy_inode() queues
> i_callback() with call_rcu(), and i_callback() then calls the
> ->free_inode() of the super block, configfs_free_inode(). Nothing in
> configfs_exit() waits for these callbacks, so the module can go away
> while some of them are still pending, and they later jump into freed
> module text.

Is this still the case on mainline? Since commit 3bc999d944b3 ("mm/slab:
introduce kfree_rcu_nolock()") in v7.3, kmem_cache_destroy() calls
rcu_barrier() unconditionally, and configfs_exit() already reaches it:

configfs_exit()
	kmem_cache_destroy(configfs_dir_cachep)
		kvfree_rcu_barrier_on_cache()
			rcu_barrier()

so the pending configfs_free_inode() calls finish before configfs_exit()
returns.