On Wed, May 06 2026 at 18:29, Thomas Gleixner wrote:
> On Mon, May 04 2026 at 05:23, syzbot wrote:
>>
>> ------------[ cut here ]------------
>> ODEBUG: free active (active state 0) object: ffff888033a47278 object type:
>> timer_list hint: br_ip6_multicast_port_query_expired+0x0/0x380
>> net/bridge/br_multicast.c:-1
>
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> An object which contains an active timer is RCU freed....
Unlike the other timer in the same object, the own_query timer is not
shut down in br_multicast_port_ctx_deinit()
Something kike the below.
Thanks,
tglx
---
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2030,8 +2030,10 @@ void br_multicast_port_ctx_deinit(struct
#if IS_ENABLED(CONFIG_IPV6)
timer_delete_sync(&pmctx->ip6_mc_router_timer);
+ timer_delete_sync(&pmctx->ip6_own_query_timer);
#endif
timer_delete_sync(&pmctx->ip4_mc_router_timer);
+ timer_delete_sync(&pmctx->ip4_own_query_timer);
spin_lock_bh(&br->multicast_lock);
del |= br_ip6_multicast_rport_del(pmctx);
