Hello Miquel, After ieee802154_unregister_hw() returns, the driver callbacks that can replace phy->pib have been quiesced, and hwsim_del() has exclusive ownership of the final teardown. The pointer is no longer being fetched inside an RCU read-side critical section, so rcu_dereference() is not appropriate there.
rcu_dereference_protected(phy->pib, 1) expresses that there can no longer be a concurrent updater at that point; the protection condition is the completed unregister rather than a locally held lock. The value is only fetched so the final object can be passed to kfree_rcu(). rcu_access_pointer() would also be sufficient for that limited use if you prefer it, and I can use that spelling in a v2. Thanks, Yousef On Fri, 03 Jul 2026 13:15:46 +0200, Miquel Raynal <[email protected]> wrote: > Hello Yousef, > > > @@ -1004,12 +1004,11 @@ static void hwsim_del(struct hwsim_phy *phy) > > list_del_rcu(&e->list); > > hwsim_free_edge(e); > > } > > - pib = rcu_dereference(phy->pib); > > rcu_read_unlock(); > > > > - kfree_rcu(pib, rcu); > > - > > ieee802154_unregister_hw(phy->hw); > > + pib = rcu_dereference_protected(phy->pib, 1); > > + kfree_rcu(pib, rcu); > > ieee802154_free_hw(phy->hw); > > } > > Would you mind justifying the choice for the _protected() version, > please? > > Thanks, > Miquèl
