On Thu, Sep 03, 2026 at 12:38:51PM +0300, Nikolay Aleksandrov wrote: > Sashiko reported a bug [1] that br_multicast_del_port_group unlists the > port group not using proper rcu helper that preserves the next pointer and > after that immediately frees the port group without waiting for rcu grace > period. The only rcu walker of mglist is br_multicast_list_adjacent() and > it turns out that function has always been buggy because mglist was never > properly converted to RCU. Fix it by converting it to rcu and moving its > initialization after eth_addr's. Initializing p->next can use > RCU_INIT_POINTER because we have a barrier from the hlist_add_head_rcu call > later, besides we're initializing an unpublished structure anyway. > > [1] > https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826014200.362304-1-littleddfu%40gmail.com > > Fixes: 07f8ac4a1e26 ("bridge: add export of multicast database adjacent to > net_dev") > Signed-off-by: Nikolay Aleksandrov <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
