On 12/08/2026 15:21, Nikolay Aleksandrov wrote:
>> + /* use _rcu to preserve the next pointer because it might be in use */
>> + hlist_del_init_rcu(&pg->mglist);
> Just to be clear - I'd expand the comment to include why it is safe to do
> so and under what conditions (multicast_lock held)
Thanks Nik, that is much nicer than the restart/checks dance.
hlist_del_init_rcu() works - the UAF splat is gone (7.2 + KASAN).
Before I spin anything: would you like me to send a v2 with your suggestion,
or will you fold it into the open-coded-list cleanup you mentioned? It is a
UAF with a Fixes/stable tag, so a minimal v2 now may be the easier backport,
but I am happy to leave it to your series.
If you do want the v2, here is the expanded comment I would use:
/* Keep ->next (held under multicast_lock, freed later by the GC work):
* a port->mglist teardown walk may have latched this node as its next,
* and deleting other groups of the same port must not truncate it.
*/
Thanks,
Jun
