Patch "rhashtable: Fix rhashtable_try_insert test" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rhashtable: Fix rhashtable_try_insert test

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rhashtable-fix-rhashtable_try_insert-test.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7da46412e215a57468d7ffedd5252635c7af6424
Author: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Date:   Tue Jan 14 11:15:19 2025 +0800

    rhashtable: Fix rhashtable_try_insert test
    
    [ Upstream commit 9d4f8e54cef2c42e23ef258833dbd06a1eaff89b ]
    
    The test on whether rhashtable_insert_one did an insertion relies
    on the value returned by rhashtable_lookup_one.  Unfortunately that
    value is overwritten after rhashtable_insert_one returns.  Fix this
    by moving the test before data gets overwritten.
    
    Simplify the test as only data == NULL matters.
    
    Finally move atomic_inc back within the lock as otherwise it may
    be reordered with the atomic_dec on the removal side, potentially
    leading to an underflow.
    
    Reported-by: Michael Kelley <mhklinux@xxxxxxxxxxx>
    Fixes: e1d3422c95f0 ("rhashtable: Fix potential deadlock by moving schedule_work outside lock")
    Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    Tested-by: Michael Kelley <mhklinux@xxxxxxxxxxx>
    Reviewed-by: Breno Leitao <leitao@xxxxxxxxxx>
    Tested-by: Mikhail Zaslonko <zaslonko@xxxxxxxxxxxxx>
    Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index bf956b85455ab..0e9a1d4cf89be 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -611,21 +611,23 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
 			new_tbl = rht_dereference_rcu(tbl->future_tbl, ht);
 			data = ERR_PTR(-EAGAIN);
 		} else {
+			bool inserted;
+
 			flags = rht_lock(tbl, bkt);
 			data = rhashtable_lookup_one(ht, bkt, tbl,
 						     hash, key, obj);
 			new_tbl = rhashtable_insert_one(ht, bkt, tbl,
 							hash, obj, data);
+			inserted = data && !new_tbl;
+			if (inserted)
+				atomic_inc(&ht->nelems);
 			if (PTR_ERR(new_tbl) != -EEXIST)
 				data = ERR_CAST(new_tbl);
 
 			rht_unlock(tbl, bkt, flags);
 
-			if (PTR_ERR(data) == -ENOENT && !new_tbl) {
-				atomic_inc(&ht->nelems);
-				if (rht_grow_above_75(ht, tbl))
-					schedule_work(&ht->run_work);
-			}
+			if (inserted && rht_grow_above_75(ht, tbl))
+				schedule_work(&ht->run_work);
 		}
 	} while (!IS_ERR_OR_NULL(new_tbl));