Re: [PATCH net v3] ipv4: igmp: remove multicast group from hash table on device destruction

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Thu,  2 Jul 2026 08:50:14 +0900 you wrote:

When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc_hash).

Since the device remains published in dev->ip_ptr until after
ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.

[...]

Here is the summary with links:
  - [net,v3] ipv4: igmp: remove multicast group from hash table on device destruction
    https://git.kernel.org/netdev/net/c/7993211bde16

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html