Re: [PATCH net-next v2] ipv4: igmp: annotate data-races around im->users

[Ido Schimmel]

On Fri, May 22, 2026 at 06:39:06PM +0900, Yuyang Huang wrote:
> /proc/net/igmp walks IPv4 multicast memberships under RCU and
> prints im->users without holding RTNL, while multicast join and leave
> paths update the field while holding RTNL. Annotate this intentional
> lockless snapshot with READ_ONCE() and the matching writers with
> WRITE_ONCE().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Yuyang Huang <sigefriedhyy@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>

> ---
> Changes in v2:
>   - Added Fixes: tag
> 
>  net/ipv4/igmp.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
> index 27d120183779..f2aca659b29c 100644
> --- a/net/ipv4/igmp.c
> +++ b/net/ipv4/igmp.c
> @@ -1541,7 +1541,7 @@ static void ____ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
>  	}
>  
>  	if  (im) {
> -		im->users++;
> +		WRITE_ONCE(im->users, im->users + 1);
>  		ip_mc_add_src(in_dev, &addr, mode, 0, NULL, 0);
>  		goto out;
>  	}
> @@ -1550,7 +1550,7 @@ static void ____ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
>  	if (!im)
>  		goto out;
>  
> -	im->users = 1;
> +	WRITE_ONCE(im->users, 1);

This one isn't necessary since the object was just allocated and not yet
published