Re: [PATCH] net: bridge: mcast: don't truncate the port group walk on teardown

On 12/08/2026 15:21, Nikolay Aleksandrov wrote:
>> +	/* use _rcu to preserve the next pointer because it might be in use */
>> +	hlist_del_init_rcu(&pg->mglist);
> Just to be clear - I'd expand the comment to include why it is safe to do
> so and under what conditions (multicast_lock held)

Thanks Nik, that is much nicer than the restart/checks dance.
hlist_del_init_rcu() works - the UAF splat is gone (7.2 + KASAN).

Before I spin anything: would you like me to send a v2 with your suggestion,
or will you fold it into the open-coded-list cleanup you mentioned? It is a
UAF with a Fixes/stable tag, so a minimal v2 now may be the easier backport,
but I am happy to leave it to your series.

If you do want the v2, here is the expanded comment I would use:

	/* Keep ->next (held under multicast_lock, freed later by the GC work):
	 * a port->mglist teardown walk may have latched this node as its next,
	 * and deleting other groups of the same port must not truncate it.
	 */

Thanks,
Jun