Re: [PATCH v2 net 3/3] ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

[Ido Schimmel <idosch@nvidia.com>]

On Sun, Jul 05, 2026 at 06:17:56PM +0000, Eric Dumazet wrote:
> When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped
> in igmp_stop_timer(), the code currently decrements the reference counter
> of the multicast list entry @im using refcount_dec(&im->refcnt).
> 
> However, both functions can be called from the RCU reader path:
> - igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu()
> - igmp_stop_timer() via igmp_rcv() -> igmp_heard_report()
> 
> If the group im was concurrently removed from the list by ip_mc_dec_group(),
> its reference count might have already been decremented to 1.
> 
> In this case, timer_delete() succeeds, and refcount_dec() decrements
> the refcount from 1 to 0. Since refcount_dec() does not free the object
> when it hits 0 (unlike ip_ma_put()), the im structure is leaked.
> 
> Fix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt),
> and deferring the put until after the spinlock is released.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>