Re: [PATCH] RDMA/multicast: Fix rb-tree corruption on MGID reassignment in join_handler

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> When the SA assigns a wildcard (mgid0) join a concrete MGID that already
> has a group in the port table, join_handler() erases the group from the
> tree and calls mcast_insert() with allow_duplicates=false.  mcast_insert()
> then finds the existing group and returns it without re-inserting, but
> join_handler() discards the return value, leaving the group erased yet
> still alive.
> 
> When the orphaned group's refcount later drops to zero, release_group()
> calls rb_erase() on the node that is no longer in the tree, corrupting
> the rb-tree (a stale parent pointer causes a valid subtree link to be
> overwritten with NULL).
> 
> Clear the node with RB_CLEAR_NODE() after the erase in join_handler() so
> release_group() can detect via RB_EMPTY_NODE() that it is already out of
> the tree and skip the second erase.  A successful re-insert by
> mcast_insert() restores the in-tree state via rb_link_node().
> 
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917052012.2181-1-lirongqing@baidu.com?part=1