Re: [PATCH v2 net 4/5] ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Aug 28, 2026 at 08:45:30AM +0000, Eric Dumazet wrote:
> Several places in net/ipv6/mcast.c update RCU-protected lists
> (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer
> assignments instead of rcu_assign_pointer():
> 
> 1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:
>        *map = ma->next;
>    without rcu_assign_pointer() while concurrent readers traverse
>    idev->mc_list locklessly under rcu_read_lock().
> 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group
>    from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and
>    np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing
>    with lockless readers in inet6_mc_check().
> 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to
>    np->ipv6_mc_list via raw assignment before publishing mc_lst.
> 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers
>    passed into rcu_assign_pointer() lacked explicit dereference helpers.
> 
> Fix these by consistently using rcu_assign_pointer() along with
> mc_dereference() / sock_dereference().
> 
> Fixes: 456b61bca8ee ("ipv6: mcast: RCU conversion")
> Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Taehee Yoo <ap420073@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

[...]

> @@ -980,7 +985,7 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
>  		return -ENOMEM;
>  	}
>  
> -	rcu_assign_pointer(mc->next, idev->mc_list);
> +	rcu_assign_pointer(mc->next, mc_dereference(idev->mc_list, idev));
>  	rcu_assign_pointer(idev->mc_list, mc);
>  
>  	mld_del_delrec(idev, mc);

In case you need another version:

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index aaba4c2aae23..bb1b8957967f 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -763,7 +763,7 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 			psf->sf_crcount = pmc->mca_crcount;
 	}
 
-	rcu_assign_pointer(pmc->next, idev->mc_tomb);
+	rcu_assign_pointer(pmc->next, mc_dereference(idev->mc_tomb, idev));
 	rcu_assign_pointer(idev->mc_tomb, pmc);
 }