[PATCH net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

[PATCH net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

[Yue Haibing]

pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
does, the reference should be put after ip6_mc_clear_src() return.

Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
---
 net/ipv6/mcast.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 65831b4fee1f..616bf4c0c8fd 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -807,8 +807,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 		} else {
 			im->mca_crcount = idev->mc_qrv;
 		}
-		in6_dev_put(pmc->idev);
 		ip6_mc_clear_src(pmc);
+		in6_dev_put(pmc->idev);
 		kfree_rcu(pmc, rcu);
 	}
 }
-- 
2.34.1

Re: [PATCH net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 14 Jul 2025 22:19:57 +0800 you wrote:
> pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
> does, the reference should be put after ip6_mc_clear_src() return.
> 
> Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
> Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
> ---
>  net/ipv6/mcast.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Here is the summary with links:
  - [net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
    https://git.kernel.org/netdev/net/c/ae3264a25a46

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec(): manual merge

[Matthieu Baerts]

[-- Attachment #1: Type: text/plain, Size: 1387 bytes --]

Hi Yue, Paolo, Jakub,

On 14/07/2025 16:19, Yue Haibing wrote:
> pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
> does, the reference should be put after ip6_mc_clear_src() return.

FYI, I got a small conflict when merging 'net' in 'net-next' in the
MPTCP tree due to this patch applied in 'net':

  ae3264a25a46 ("ipv6: mcast: Delay put pmc->idev in mld_del_delrec()")

and this one from 'net-next':

  a8594c956cc9 ("ipv6: mcast: Avoid a duplicate pointer check in
mld_del_delrec()")

----- Generic Message -----
The best is to avoid conflicts between 'net' and 'net-next' trees but if
they cannot be avoided when preparing patches, a note about how to fix
them is much appreciated.

The conflict has been resolved on our side[1] and the resolution we
suggest is attached to this email. Please report any issues linked to
this conflict resolution as it might be used by others. If you worked on
the mentioned patches, don't hesitate to ACK this conflict resolution.
---------------------------

Regarding this conflict, the patch from net has been applied at a
slightly different place after the code refactoring from net-next.

Rerere cache is available in [2].

[1] https://github.com/multipath-tcp/mptcp_net-next/commit/ec9d9e40de20
[2] https://github.com/multipath-tcp/mptcp-upstream-rr-cache/commit/fe71

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

[-- Attachment #2: ec9d9e40de2017c816864c2193a8a255ddd32815.patch --]
[-- Type: text/x-patch, Size: 2059 bytes --]

diff --cc net/ipv6/mcast.c
index 0c63c33ab080,616bf4c0c8fd..36ca27496b3c
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@@ -786,34 -783,37 +786,34 @@@ static void mld_del_delrec(struct inet6
  			break;
  		pmc_prev = pmc;
  	}
 -	if (pmc) {
 -		if (pmc_prev)
 -			rcu_assign_pointer(pmc_prev->next, pmc->next);
 -		else
 -			rcu_assign_pointer(idev->mc_tomb, pmc->next);
 -	}
 +	if (!pmc)
 +		return;
 +	if (pmc_prev)
 +		rcu_assign_pointer(pmc_prev->next, pmc->next);
 +	else
 +		rcu_assign_pointer(idev->mc_tomb, pmc->next);
  
 -	if (pmc) {
 -		im->idev = pmc->idev;
 -		if (im->mca_sfmode == MCAST_INCLUDE) {
 -			tomb = rcu_replace_pointer(im->mca_tomb,
 -						   mc_dereference(pmc->mca_tomb, pmc->idev),
 -						   lockdep_is_held(&im->idev->mc_lock));
 -			rcu_assign_pointer(pmc->mca_tomb, tomb);
 +	im->idev = pmc->idev;
 +	if (im->mca_sfmode == MCAST_INCLUDE) {
 +		tomb = rcu_replace_pointer(im->mca_tomb,
 +					   mc_dereference(pmc->mca_tomb, pmc->idev),
 +					   lockdep_is_held(&im->idev->mc_lock));
 +		rcu_assign_pointer(pmc->mca_tomb, tomb);
  
 -			sources = rcu_replace_pointer(im->mca_sources,
 -						      mc_dereference(pmc->mca_sources, pmc->idev),
 -						      lockdep_is_held(&im->idev->mc_lock));
 -			rcu_assign_pointer(pmc->mca_sources, sources);
 -			for_each_psf_mclock(im, psf)
 -				psf->sf_crcount = idev->mc_qrv;
 -		} else {
 -			im->mca_crcount = idev->mc_qrv;
 -		}
 -		ip6_mc_clear_src(pmc);
 -		in6_dev_put(pmc->idev);
 -		kfree_rcu(pmc, rcu);
 +		sources = rcu_replace_pointer(im->mca_sources,
 +					      mc_dereference(pmc->mca_sources, pmc->idev),
 +					      lockdep_is_held(&im->idev->mc_lock));
 +		rcu_assign_pointer(pmc->mca_sources, sources);
 +		for_each_psf_mclock(im, psf)
 +			psf->sf_crcount = idev->mc_qrv;
 +	} else {
 +		im->mca_crcount = idev->mc_qrv;
  	}
- 	in6_dev_put(pmc->idev);
 +	ip6_mc_clear_src(pmc);
++	in6_dev_put(pmc->idev);
 +	kfree_rcu(pmc, rcu);
  }
  
 -/* called with mc_lock */
  static void mld_clear_delrec(struct inet6_dev *idev)
  {
  	struct ifmcaddr6 *pmc, *nextpmc;

Re: [PATCH net] ipv6: mcast: Delay put pmc->idev in mld_del_delrec(): manual merge

[Yue Haibing]

On 2025/7/17 22:41, Matthieu Baerts wrote:
> Hi Yue, Paolo, Jakub,
> 
> On 14/07/2025 16:19, Yue Haibing wrote:
>> pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
>> does, the reference should be put after ip6_mc_clear_src() return.
> 
> FYI, I got a small conflict when merging 'net' in 'net-next' in the
> MPTCP tree due to this patch applied in 'net':
> 
>   ae3264a25a46 ("ipv6: mcast: Delay put pmc->idev in mld_del_delrec()")
> 
> and this one from 'net-next':
> 
>   a8594c956cc9 ("ipv6: mcast: Avoid a duplicate pointer check in
> mld_del_delrec()")
> 
> ----- Generic Message -----
> The best is to avoid conflicts between 'net' and 'net-next' trees but if
> they cannot be avoided when preparing patches, a note about how to fix
> them is much appreciated.

Sorry for the inconvenience.
> 
> The conflict has been resolved on our side[1] and the resolution we
> suggest is attached to this email. Please report any issues linked to
> this conflict resolution as it might be used by others. If you worked on
> the mentioned patches, don't hesitate to ACK this conflict resolution.
> ---------------------------
> 
> Regarding this conflict, the patch from net has been applied at a
> slightly different place after the code refactoring from net-next.
> 

This resolution looks good to me.

> Rerere cache is available in [2].
> 
> [1] https://github.com/multipath-tcp/mptcp_net-next/commit/ec9d9e40de20
> [2] https://github.com/multipath-tcp/mptcp-upstream-rr-cache/commit/fe71
> 
> Cheers,
> Matt