From: "Paul E. McKenney" <redacted>
Date: Mon, 29 Oct 2007 14:15:40 -0700

net/decnet/dn_route.c in dn_rt_cache_get_next() is as follows:

static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
{
	struct dn_rt_cache_iter_state *s = rcu_dereference(seq->private);

	rt = rt->u.dst.dn_next;
	while(!rt) {
		rcu_read_unlock_bh();
		if (--s->bucket < 0)
			break;

...  But what happens if seq->private is freed up right here?
...  Or what prevents this from happening?

 ...

Similar code is in rt_cache_get_next().

So, what am I missing here?

seq->private is allocated on file open (here via seq_open_private()),
and freed up on file close (via seq_release_private).

So it cannot be freed up in the middle of an iteration.