On Fri, Aug 28, 2026 at 01:06:42PM +0300, Nikolay Aleksandrov wrote: > Sashiko reported a bug [1] that br_multicast_del_port_group unlists the > port group not using proper rcu helper that preserves the next pointer and > after that immediately frees the port group without waiting for rcu grace > period. The only rcu walker of mglist is br_multicast_list_adjacent() and > it turns out that function has always been buggy because mglist was never > converted to RCU. Fix it by acquiring the bridge's multicast lock for the > mglist walk. We can do a proper mglist rcu conversion later. > > [1] > https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com > > Fixes: 07f8ac4a1e26 ("bridge: add export of multicast database adjacent to > net_dev") > Signed-off-by: Nikolay Aleksandrov <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
