Re: [PATCH v2] RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

[Leon Romanovsky]

On Tue, 16 Jun 2026 22:27:28 -0400, Michael Bommarito wrote:
> rxe_get_mcg() publishes a newly allocated multicast group in
> rxe->mcg_tree before programming the backing Ethernet multicast address
> with rxe_mcast_add(), which runs outside mcg_lock. A local userspace
> RDMA client reaches this path with ATTACH_MCAST on a UD QP; if
> rxe_mcast_add() then returns an error (for example -ENODEV when the
> backing netdev has been removed, or a propagated dev_mc_add() error),
> the unwind frees the published group without removing it from the tree.
> A later lookup of the same MGID dereferences the freed struct rxe_mcg
> from __rxe_lookup_mcg().
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
      https://git.kernel.org/rdma/rdma/c/1caceeb2d74bbe

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>