Re: [PATCH net] ipv6: mld: use ma_put() after canceling mca delayed work

[Ido Schimmel]

On Mon, Jul 27, 2026 at 05:41:07PM +0800, Minhong He wrote:
> When cancel_delayed_work() succeeds, MLD drops the work reference with
> refcount_dec(). Unlike ma_put(), that does not free the ifmcaddr6 when
> the count reaches zero.
> 
> Use ma_put() on stop paths. On restart paths, re-arm the delayed work
> before dropping the old reference, matching the ordering used for IPv4
> IGMP timer updates.
> 
> Similar to commit 3546deaa0c30 ("ipv4: igmp: Fix potential memory leaks
> in igmp_mod_timer() and igmp_stop_timer()").

In IPv4 the readers grab the multicast group from in_dev->mc_list using
RCU so they could race with the removal of the group from the list. In
IPv6, AFAICT, the readers iterate over the list using the idev->mc_lock
mutex, so I don't see how the same race can happen there.