Re: [PATCH] RDMA/multicast: Fix rb-tree corruption on MGID reassignment in join_handler

[Leon Romanovsky <leon@kernel.org>]

On Thu, Sep 17, 2026 at 01:20:12PM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> When the SA assigns a wildcard (mgid0) join a concrete MGID that already
> has a group in the port table, join_handler() erases the group from the
> tree and calls mcast_insert() with allow_duplicates=false.  mcast_insert()
> then finds the existing group and returns it without re-inserting, but
> join_handler() discards the return value, leaving the group erased yet
> still alive.
> 
> When the orphaned group's refcount later drops to zero, release_group()
> calls rb_erase() on the node that is no longer in the tree, corrupting
> the rb-tree (a stale parent pointer causes a valid subtree link to be
> overwritten with NULL).
> 
> Clear the node with RB_CLEAR_NODE() after the erase in join_handler() so
> release_group() can detect via RB_EMPTY_NODE() that it is already out of
> the tree and skip the second erase.  A successful re-insert by
> mcast_insert() restores the in-tree state via rb_link_node().
> 
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/infiniband/core/multicast.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)

I'm not sure whether this change makes any difference, but at least it is
harmless.

Thanks