Files
linux/include/net
Eric Dumazet c073d1b070 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
pmc->sflist is read locklessly under rcu_read_lock() by
inet6_mc_check() during packet reception in the UDP and RAW
multicast receive paths.

ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place
when adding or removing a source filter. Additionally, when expanding
the filter buffer, newpsl was published via rcu_assign_pointer()
before writing the new source into the array.

Because 16-byte struct in6_addr writes are not atomic and array
shifting is not synchronized with RCU readers, concurrent readers in
inet6_mc_check() could read torn IPv6 addresses or observe
duplicated/missed source entries.

Fix this by switching ip6_mc_source() to copy-on-write RCU updates:
allocate and fully populate newpsl before publishing it via
rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),
matching ip6_mc_msfilter().

Also remove the now unused IP6_SFBLOCK macro.

Fixes: 882ba1f73c ("mld: convert ipv6_mc_socklist->sflist to RCU")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260828084531.1826790-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-31 17:54:45 -07:00
..
2025-04-24 17:03:45 -07:00
2026-08-18 15:50:13 +02:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2024-08-26 09:37:23 -07:00
2026-08-13 12:30:27 +02:00
2024-12-06 17:43:08 -08:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-04-11 18:58:10 -07:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2025-07-11 11:00:57 -07:00
2023-07-28 14:07:59 -07:00
2026-03-13 18:57:44 -07:00