Re: [PATCH] net: bridge: mcast: don't truncate the port group walk on teardown

On 25/08/2026 13:19, Jun Yang wrote:
> On 12/08/2026 15:21, Nikolay Aleksandrov wrote:
>>> +	/* use _rcu to preserve the next pointer because it might be in use */
>>> +	hlist_del_init_rcu(&pg->mglist);
>> Just to be clear - I'd expand the comment to include why it is safe to do
>> so and under what conditions (multicast_lock held)
> 
> Thanks Nik, that is much nicer than the restart/checks dance.
> hlist_del_init_rcu() works - the UAF splat is gone (7.2 + KASAN).
> 
> Before I spin anything: would you like me to send a v2 with your suggestion,
> or will you fold it into the open-coded-list cleanup you mentioned? It is a
> UAF with a Fixes/stable tag, so a minimal v2 now may be the easier backport,
> but I am happy to leave it to your series.
> 
> If you do want the v2, here is the expanded comment I would use:
> 
> 	/* Keep ->next (held under multicast_lock, freed later by the GC work):
> 	 * a port->mglist teardown walk may have latched this node as its next,
> 	 * and deleting other groups of the same port must not truncate it.
> 	 */
> 
> Thanks,
> Jun

Please send v2, I don't know when I'll have time to prepare my changes.
The comment sounds good to me.

Thanks!