Re: [PATCH v2 net 1/5] ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
From: Ido Schimmel <idosch@nvidia.com>
Date: 2026-08-30 15:44:19
On Fri, Aug 28, 2026 at 08:45:27AM +0000, Eric Dumazet wrote:
When removing a source filter whose count reaches zero, ip6_mc_del1_src()
unlinks psf from pmc->mca_sources. If the filter was previously active,
the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.
Because pmc->mca_sources is traversed locklessly under RCU (e.g. by
ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period
elapses diverts concurrent readers to the tombstone list. Consequently,
readers miss remaining active sources in pmc->mca_sources and improperly
examine deleted tombstone entries.
Fix this by allocating a new tombstone node for pmc->mca_tomb (as done
in sf_setstate()) and retiring the original psf via kfree_rcu().
Fixes: 4b200e398953 ("mld: convert ip6_sf_list to RCU")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>Reviewed-by: Ido Schimmel <idosch@nvidia.com>