From 3b2e9b05011ee74543b6d17401bb02f1df3b93ff Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Sat, 3 Oct 2026 17:38:06 +0800 Subject: [PATCH] vfio/pci: Drain eventfd RCU callbacks on module exit vfio_pci_eventfd_replace_locked() defers freeing replaced eventfds to vfio_pci_eventfd_rcu_free(). A callback can remain queued after close_device() returns and the device driver module reference is dropped. Once the dependent driver is removed, vfio-pci-core can be unloaded while the callback still points into its module text. Wait for outstanding RCU callbacks before vfio-pci-core exits. Fixes: 98693e0897f7 ("vfio/pci: Use RCU for error/request triggers to avoid circular locking") Signed-off-by: Jiale Yao Link: https://lore.kernel.org/r/20261003093806.544631-1-yaojiale02@163.com Signed-off-by: Alex Williamson --- drivers/vfio/pci/vfio_pci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c index 6757054e9d87..9bce419c52c8 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -2675,6 +2675,7 @@ static void vfio_pci_dev_set_try_reset(struct vfio_device_set *dev_set) static void vfio_pci_core_cleanup(void) { vfio_pci_uninit_perm_bits(); + rcu_barrier(); } static int __init vfio_pci_core_init(void)