Re: [PATCH net] ipv6: mld: use ma_put() after canceling mca delayed work

On Mon, Jul 27, 2026 at 05:41:07PM +0800, Minhong He wrote:

When cancel_delayed_work() succeeds, MLD drops the work reference with
refcount_dec(). Unlike ma_put(), that does not free the ifmcaddr6 when
the count reaches zero.

Use ma_put() on stop paths. On restart paths, re-arm the delayed work
before dropping the old reference, matching the ordering used for IPv4
IGMP timer updates.

Similar to commit 3546deaa0c30 ("ipv4: igmp: Fix potential memory leaks
in igmp_mod_timer() and igmp_stop_timer()").

In IPv4 the readers grab the multicast group from in_dev->mc_list using
RCU so they could race with the removal of the group from the list. In
IPv6, AFAICT, the readers iterate over the list using the idev->mc_lock
mutex, so I don't see how the same race can happen there.