[PATCH net] ipv4/ipv6: preserve multicast filters after a failed source leave

[PATCH net] ipv4/ipv6: preserve multicast filters after a failed source leave

[Xia Yan]

After joining a group with IP_ADD_MEMBERSHIP or IPV6_JOIN_GROUP,
MCAST_LEAVE_SOURCE_GROUP for an unjoined source returns EADDRNOTAVAIL
but switches the socket's filter mode, so the existing membership stops
receiving. Leaving and rejoining the group restores reception.
IP_DROP_SOURCE_MEMBERSHIP has the same problem.

ip_mc_source() and ip6_mc_source() allow an empty-filter mode switch before
checking whether a source list exists for deletion. The failed request
changes EXCLUDE {} to INCLUDE {}, so the socket no longer accepts packets
from any source.

Check for a missing source list before changing the filter mode. Preserve
EADDRNOTAVAIL for the rejected deletion and keep mode switches for valid
source additions.

Found while reviewing the error paths of ip_mc_source() and
ip6_mc_source().
The reproducer uses socket calls without kernel changes or fault injection.

Tested with a UDP socket reproducer under UML using the IPv4 generic and
legacy APIs and the IPv6 generic API. All three paths lose reception
before this change and keep receiving with the fix. Source joins and
leaves, block/unblock, last-source leave, and ordinary leave/rejoin also
pass.

W=1 x86_64 builds with derived allmodconfig and allyesconfig configurations
also pass, with no changes to the warning sets.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
---

Validation used net fcc00b15cb21a6de76826e5012b2c758505f5e65.
Both files are identical at the base commit.
For the x86_64 builds, the derived configurations disable WERROR and
KASAN; the derived allyesconfig also disables KUNIT_ALL_TESTS. The complete
before/after warning sets are identical for each configuration.

 net/ipv4/igmp.c  | 7 ++++---
 net/ipv6/mcast.c | 7 ++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 144fca158adcb..9c38045e38731 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2520,6 +2520,10 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
 		err = -EINVAL;
 		goto done;
 	}
+	psl = rtnl_dereference(pmc->sflist);
+	if (!add && !psl)
+		goto done;	/* err = -EADDRNOTAVAIL */
+
 	/* if a source filter was set, must be the same mode as before */
 	if (pmc->sflist) {
 		if (pmc->sfmode != omode) {
@@ -2534,10 +2538,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
 		pmc->sfmode = omode;
 	}
 
-	psl = rtnl_dereference(pmc->sflist);
 	if (!add) {
-		if (!psl)
-			goto done;	/* err = -EADDRNOTAVAIL */
 		rv = !0;
 		for (i = 0; i < psl->sl_count; i++) {
 			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index ecef55f261890..2ade3351c904a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -395,6 +395,10 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 		err = -EINVAL;
 		goto done;
 	}
+	psl = sock_dereference(pmc->sflist, sk);
+	if (!add && !psl)
+		goto done;	/* err = -EADDRNOTAVAIL */
+
 	/* if a source filter was set, must be the same mode as before */
 	if (rcu_access_pointer(pmc->sflist)) {
 		if (pmc->sfmode != omode) {
@@ -408,10 +412,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 		pmc->sfmode = omode;
 	}
 
-	psl = sock_dereference(pmc->sflist, sk);
 	if (!add) {
-		if (!psl)
-			goto done;	/* err = -EADDRNOTAVAIL */
 		for (i = 0; i < psl->sl_count; i++) {
 			if (ipv6_addr_equal(&psl->sl_addr[i], source))
 				break;

base-commit: 5838f10563d58afca6711edb5e4eda968ca181d9
-- 
2.39.0.windows.2

Re: [PATCH net] ipv4/ipv6: preserve multicast filters after a failed source leave

[Xia Yan]

Hi,

The Sashiko review of this patch has two open Medium concerns [1].
Both describe behavior this patch does not change. My reading of each:

1) Empty-filter mode switch before the allocation in ip_mc_source() and
   ip6_mc_source().

   The mode-switch block is untouched. The diff only moves the sflist
   dereference up and returns early when no source list exists for a
   deletion. Add requests still reach the block in the original order,
   so a mode switch followed by a failed allocation is preexisting
   behavior. Restructuring that path would grow this stable-targeted
   fix well beyond the bug it addresses. I'm happy to look at it as
   follow-up work if there is interest.

2) IPv4 leaves a non-NULL, empty sflist after unblock, while IPv6 frees
   it.

   This patch changes neither when a source list is freed nor when it
   is kept. For a non-NULL empty list the new early check is a no-op:
   the delete path already tested !psl further down, and the mode check
   keyed on pmc->sflist before this change. The asymmetry predates the
   patch. Unifying it would alter observable behavior on a long-stable
   path, so it looks like a separate discussion to me.

No respin planned for these two. I will follow up if a maintainer
sees them differently.

[1] https://sashiko.dev/#/patchset/98602

Best regards,
Xia Yan

Re: [PATCH net] ipv4/ipv6: preserve multicast filters after a failed source leave

[Ido Schimmel]

On Fri, Oct 30, 2026 at 02:36:03PM +0800, Xia Yan wrote:
> After joining a group with IP_ADD_MEMBERSHIP or IPV6_JOIN_GROUP,
> MCAST_LEAVE_SOURCE_GROUP for an unjoined source returns EADDRNOTAVAIL
> but switches the socket's filter mode, so the existing membership stops
> receiving. Leaving and rejoining the group restores reception.
> IP_DROP_SOURCE_MEMBERSHIP has the same problem.
> 
> ip_mc_source() and ip6_mc_source() allow an empty-filter mode switch before
> checking whether a source list exists for deletion. The failed request
> changes EXCLUDE {} to INCLUDE {}, so the socket no longer accepts packets
> from any source.
> 
> Check for a missing source list before changing the filter mode. Preserve
> EADDRNOTAVAIL for the rejected deletion and keep mode switches for valid
> source additions.
> 
> Found while reviewing the error paths of ip_mc_source() and
> ip6_mc_source().
> The reproducer uses socket calls without kernel changes or fault injection.
> 
> Tested with a UDP socket reproducer under UML using the IPv4 generic and
> legacy APIs and the IPv6 generic API. All three paths lose reception
> before this change and keep receiving with the fix. Source joins and
> leaves, block/unblock, last-source leave, and ordinary leave/rejoin also
> pass.
> 
> W=1 x86_64 builds with derived allmodconfig and allyesconfig configurations
> also pass, with no changes to the warning sets.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>

Same comment as:

https://lore.kernel.org/netdev/20261030151629.GA85001@shredder/

Not a regression and not a security issue / crash. Please target
net-next and drop the Fixes and stable tags.