From 7a188fcc18d4f2ee47dc8aa7468bf17a00fa6926 Mon Sep 17 00:00:00 2001 From: Ido Schimmel Date: Wed, 3 Jun 2026 13:35:22 +0300 Subject: [PATCH] bridge: mcast: Synchronously shutdown port multicast timers Currently, while four timers are set up during port multicast context initialization, only two are synchronously deleted when the context is de-initialized, just before being deleted. This is fine because the structure containing the multicast context (either a bridge port or a VLAN) is only deleted after an RCU grace period and it will not pass as long as the timers are executing. These timers are also not supposed to do any work at this stage. They acquire the bridge multicast lock, see that the multicast context was disabled and exit. Make the code more explicit and symmetric and synchronously shutdown all four timers when the multicast context is de-initialized. Use timer_shutdown_sync() to guarantee that the timers will not be re-armed given that the containing structure is being deleted. Acked-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260603103522.622411-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski --- net/bridge/br_multicast.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index 5d6fdfb43c04..c2c93c740415 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -2027,9 +2027,11 @@ void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pmctx) bool del = false; #if IS_ENABLED(CONFIG_IPV6) - timer_delete_sync(&pmctx->ip6_mc_router_timer); + timer_shutdown_sync(&pmctx->ip6_own_query.timer); + timer_shutdown_sync(&pmctx->ip6_mc_router_timer); #endif - timer_delete_sync(&pmctx->ip4_mc_router_timer); + timer_shutdown_sync(&pmctx->ip4_own_query.timer); + timer_shutdown_sync(&pmctx->ip4_mc_router_timer); spin_lock_bh(&br->multicast_lock); del |= br_ip6_multicast_rport_del(pmctx);