Eric Dumazet c073d1b070 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() ... pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro. Fixes: 882ba1f73c ("mld: convert ipv6_mc_socklist->sflist to RCU") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Taehee Yoo <ap420073@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260828084531.1826790-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-08-31 17:54:45 -07:00
..
9p	9p: Cache negative dentries for lookup performance	2026-06-21 05:22:56 +00:00
bluetooth	Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan	2026-08-24 13:06:49 -04:00
iucv
libeth	xsk: honor XDP_TX_METADATA in zero-copy path	2026-08-24 11:12:00 -07:00
mana	RDMA v7.3 merge window pull	2026-08-21 11:48:54 -07:00
netfilter	netfilter: nf_tables: skip double clone set expressions on element insert	2026-08-27 16:10:57 +02:00
netns	ipv4: fib: Define fib_table_hash_lock under CONFIG_IP_MULTIPLE_TABLES.	2026-07-07 10:51:06 +02:00
nfc
page_pool	net: make page_pool_get_stats() void	2026-05-28 18:10:03 -07:00
phonet
phy
psp	psp: add new netlink cmd for dev-assoc and dev-disassoc	2026-06-12 18:31:32 -07:00
sctp	sctp: fix stream->outcnt underflow on duplicate RECONF responses	2026-08-25 13:33:08 +02:00
tc_act	net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload	2026-07-06 12:52:01 +02:00
6lowpan.h
act_api.h	net/sched: act_gact, act_police: range check the fallback control action	2026-08-10 16:00:19 -07:00
addrconf.h	ipv6: prevent in6_dev_get() from resurrecting inet6_dev	2026-08-04 14:42:45 -07:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
af_vsock.h	vsock/virtio: validate packet source for connected sockets	2026-08-31 16:50:54 -07:00
ah.h
aligned_data.h
amt.h
arp.h
ax25.h
ax88796.h
bareudp.h
bond_3ad.h	bonding: no longer rely on RTNL in bond_fill_info()	2026-06-30 17:00:03 -07:00
bond_alb.h
bond_options.h	bonding: 3ad: add lacp_strict configuration knob	2026-06-10 07:53:26 -07:00
bonding.h	bonding: no longer rely on RTNL in bond_fill_info()	2026-06-30 17:00:03 -07:00
bpf_sk_storage.h
busy_poll.h
calipso.h
can.h
cfg80211-wext.h
cfg80211.h	wifi: cfg80211: convert tx_control_port cookie to input parameter	2026-08-02 17:40:08 +02:00
cfg802154.h
checksum.h
cipso_ipv4.h
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: add generic device max_sfs parameter	2026-08-11 18:06:30 -07:00
dropreason-core.h
dropreason-qdisc.h
dropreason.h
dsa_stubs.h
dsa.h	net: dsa: initial MT7628 tagging driver	2026-08-18 15:50:13 +02:00
dscp.h
dsfield.h
dst_cache.h
dst_metadata.h	net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone	2026-06-21 14:33:05 -07:00
dst_ops.h
dst.h
eee.h
erspan.h
esp.h
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h	net: fib_rules: Only hold RTNL for the first IPv4 RTM_NEWRULE.	2026-07-01 18:42:34 +02:00
firewire.h
flow_dissector.h
flow_offload.h
flow.h
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h	net/sched: add const qualifiers to gnet_stats helpers	2026-05-11 18:28:08 -07:00
genetlink.h
geneve.h	net: geneve: remove unused geneve_dev_create_fb	2026-08-06 15:09:23 +02:00
gre.h	net: gre: remove unused gretap_fb_dev_create	2026-08-06 15:09:23 +02:00
gro_cells.h
gro.h
gso.h
gtp.h
gue.h	gue: validate REMCSUM private option length	2026-07-03 09:34:53 +01:00
handshake.h
hotdata.h
hwbm.h
icmp.h
ieee8021q.h
ieee80211_radiotap.h	wifi: radiotap: add definitions for the new UHR TLVs	2026-07-06 12:41:44 +02:00
ieee802154_netdev.h
if_inet6.h	ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()	2026-08-31 17:54:45 -07:00
ife.h
inet_common.h
inet_connection_sock.h
inet_dscp.h
inet_ecn.h
inet_frag.h
inet_hashtables.h
inet_sock.h
inet_timewait_sock.h
inet6_connection_sock.h
inet6_hashtables.h
inetpeer.h	inetpeer: randomize RB-tree node comparison using SipHash	2026-08-20 12:55:31 -07:00
ioam6.h
ip_fib.h	ipv4: fib: Drop RTNL annotation for net->ipv4.fib_table_hash[].	2026-07-01 18:42:33 +02:00
ip_tunnels.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-18 10:42:41 -07:00
ip_vs.h	netfilter pull request 26-08-10	2026-08-14 12:23:12 -07:00
ip.h	raw: annotate disconnect-side IPv4 match writers	2026-08-30 14:14:57 -07:00
ip6_checksum.h
ip6_fib.h	ipv6: add inet6_rt_del_notify()	2026-08-13 12:30:27 +02:00
ip6_route.h	net: advertise TCP MSS from the configured MTU, not the learned PMTU	2026-08-20 12:14:23 -07:00
ip6_tunnel.h
ipcomp.h
ipconfig.h
ipv6_frag.h
ipv6.h	tcp: rehash onto different local ECMP path on retransmit timeout	2026-06-15 15:57:31 -07:00
iw_handler.h
kcm.h
l3mdev.h
lag.h
lapb.h
llc_c_ac.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_c_ev.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_c_st.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_conn.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_if.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_pdu.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_s_ac.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_s_ev.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_s_st.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc_sap.h	llc: Add SPDX id lines to llc header files	2026-05-26 17:27:14 -07:00
llc.h	llc: Add SPDX id lines to some llc source files	2026-05-26 17:26:57 -07:00
lwtunnel.h
mac80211.h	wifi: mac80211: add ieee80211_txq_aql_pending()	2026-07-28 16:02:03 +02:00
mac802154.h
macsec.h	macsec: use rcu_work to defer TX SA crypto cleanup out of softirq	2026-05-13 19:03:05 -07:00
mctp.h
mctpdevice.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h	mptcp: remove unused data_ack from struct mptcp_ext	2026-08-17 17:25:49 -07:00
mrp.h
ncsi.h	net: ncsi: Set ncsi_stop_dev() to inline while NET_NCSI not enabled	2026-06-09 17:18:51 -07:00
ndisc.h	ipv6: ndisc: Add ndisc_check_ns_na() validation helper	2026-08-07 16:32:46 -07:00
neighbour_tables.h
neighbour.h	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()	2026-05-16 13:22:50 +02:00
net_debug.h
net_failover.h
net_namespace.h	net: enforce net sysctl registration	2026-08-13 13:12:21 +02:00
net_ratelimit.h
net_shaper.h	net_shaper: fix kernel-doc list indentation	2026-08-17 13:54:16 -07:00
net_trackers.h
netdev_lock.h	net: ethtool: make dev->hwprov ops-protected	2026-06-09 10:13:04 -07:00
netdev_netlink.h
netdev_queues.h
netdev_rx_queue.h
netevent.h
netkit.h
netlabel.h
netlink.h	netlink: add one debug check in nla_nest_end()	2026-05-14 16:49:26 -07:00
netmem.h	Revert "mm: introduce a new page type for page pool in page type"	2026-05-21 19:06:13 -07:00
netprio_cgroup.h
nexthop.h	vxlan: honor per-nexthop fdb destination port	2026-07-30 16:09:22 -07:00
nl802154.h
nsh.h
pfcp.h
pie.h
ping.h
pkt_cls.h	net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains	2026-07-20 18:16:43 -07:00
pkt_sched.h	net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup	2026-08-27 12:12:36 -07:00
pptp.h
proto_memory.h
protocol.h
psample.h
psnap.h
psp.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h
rose.h
route.h	ipv4: fix use-after-free in fib_nhc_update_mtu()	2026-08-11 11:25:10 +02:00
rpl.h
rps-types.h
rps.h
rsi_91x.h
rstreason.h
rtnetlink.h	net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink	2026-06-17 16:01:52 -07:00
rtnh.h
sch_generic.h	net/sched: reject overly deep qdisc hierarchies	2026-08-06 15:24:44 +02:00
sch_priv.h
scm.h	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h
selftests.h
slhc_vj.h
smc.h	smc: Use flexible array for SMCD connections	2026-05-20 17:13:18 -07:00
snmp.h
sock_reuseport.h
sock.h	tcp: rehash onto different local ECMP path on retransmit timeout	2026-06-15 15:57:31 -07:00
stp.h
strparser.h
switchdev.h
tc_wrapper.h
tcp_ao.h	tcp: restore RCU grace period in tcp_ao_destroy_sock	2026-06-29 18:14:30 -07:00
tcp_ecn.h
tcp_states.h
tcp.h	tcp: use GFP_ATOMIC in tcp_send_active_reset()	2026-08-28 15:35:38 -07:00
tcx.h
timewait_sock.h
tipc.h
tls_prot.h
tls.h	tls: remove tls_toe and the related driver	2026-06-12 16:43:10 -07:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h
udp.h	udp: convert udp_lib_getsockopt to sockopt_t	2026-07-02 12:29:06 +02:00
vsock_addr.h
vxlan.h	net: vxlan: remove unused vxlan_dev_create	2026-08-06 15:09:23 +02:00
wext.h
x25.h
x25device.h
xdp_priv.h
xdp_sock_drv.h	xsk: honor XDP_TX_METADATA in zero-copy path	2026-08-24 11:12:00 -07:00
xdp_sock.h	xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h	2026-08-03 16:43:54 -07:00
xdp.h
xfrm.h	xfrm: cache the offload ifindex for netlink dumps	2026-07-02 09:12:58 +02:00
xsk_buff_pool.h	xsk: honor XDP_TX_METADATA in zero-copy path	2026-08-24 11:12:00 -07:00