Re: [PATCH net v3] ipv4: igmp: remove multicast group from hash table on device destruction

[Ido Schimmel]

On Thu, Jul 02, 2026 at 08:50:14AM +0900, Yuyang Huang wrote:
> When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
> the multicast list and calls ip_ma_put() on each membership, scheduling
> them for RCU reclamation. However, they are not unlinked from the device's
> multicast hash table (mc_hash).
> 
> Since the device remains published in dev->ip_ptr until after
> ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
> can still locate and access the multicast group after its refcount is
> decremented. If the RCU callback runs and frees the group while a reader is
> accessing it, a use-after-free occurs.
> 
> Fix this by unlinking the multicast group from mc_hash using
> ip_mc_hash_remove() before scheduling it for reclamation.

[...]

> 
> Fixes: e9897071350b ("igmp: hash a hash table to speedup ip_check_mc_rcu()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yuyang Huang <yuyanghuang@xxxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>