* [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
@ 2026-11-02 9:53 Binbin Deng
2026-11-02 9:59 ` netdev-bot+sinfo
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Binbin Deng @ 2026-11-02 9:53 UTC (permalink / raw)
To: dsahern, idosch, davem, edumazet, kuba, pabeni, horms
Cc: netdev, linux-kernel, Binbin Deng
pmc->sflist is read locklessly under rcu_read_lock() by ip_mc_sf_allow()
during packet reception in the UDP and RAW multicast receive paths.
ip_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding
or removing a source filter. Additionally, when expanding the filter
buffer, newpsl was published via rcu_assign_pointer() before the new source
was written into the array.
The setsockopt writer holds RTNL and the socket lock, but neither excludes
ip_mc_sf_allow(), which traverses the filter inside an RCU read-side
critical section. During an expansion, the race looks like this:
CPU0 CPU1
ip_mc_source(add = true) ip_mc_sf_allow()
/* RTNL and socket lock held */
allocate newpsl
copy old sources into newpsl
newpsl->sl_count = old source count
rcu_assign_pointer(pmc->sflist, newpsl)
psl = newpsl
rcu_read_lock()
psl = rcu_dereference(pmc->sflist)
read psl->sl_count
shift psl->sl_addr[] for insertion
psl->sl_addr[i] = source
read psl->sl_addr[i]
psl->sl_count++
apply source-filter decision
rcu_read_unlock()
The in-place add and remove paths have the same problem after a reader has
obtained the old list: the writer shifts or appends source addresses and
updates sl_count while the reader iterates those fields. This is a data
race and can expose a mixed old/new filter state, with duplicated or missed
source entries. A multicast packet may consequently be accepted or dropped
contrary to the configured filter.
An ordinary UDP socket can trigger the race: one thread updates a source
membership while multicast traffic is received and filtered on another CPU.
No special hardware is required.
Fix this by allocating and fully populating the replacement filter before
publishing it with rcu_assign_pointer(), and by reclaiming the old filter
with kfree_rcu(). The socket source list is therefore never modified while
an RCU reader may still be traversing it.
Fixes: c85bb41e9318 ("igmp: fix ip_mc_sf_allow race [v5]")
Signed-off-by: Binbin Deng <18983559317@163.com>
---
net/ipv4/igmp.c | 107 +++++++++++++++++++++++++++++-------------------
1 file changed, 65 insertions(+), 42 deletions(-)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d56355aca797..f965091500da 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2489,10 +2489,10 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
struct ip_mc_socklist *pmc;
struct in_device *in_dev = NULL;
struct inet_sock *inet = inet_sk(sk);
- struct ip_sf_socklist *psl;
+ struct ip_sf_socklist *newpsl, *psl;
struct net *net = sock_net(sk);
int leavegroup = 0;
- int i, j, rv;
+ int count, i, j, rv;
if (!ipv4_is_multicast(addr))
return -EINVAL;
@@ -2554,13 +2554,34 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
goto done;
}
+ atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
+ &sk->sk_omem_alloc);
+
+ if (psl->sl_count == 1) {
+ newpsl = NULL;
+ } else {
+ newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr,
+ psl->sl_count - 1), GFP_KERNEL);
+ if (!newpsl) {
+ atomic_add(struct_size(psl, sl_addr, psl->sl_max),
+ &sk->sk_omem_alloc);
+ err = -ENOBUFS;
+ goto done;
+ }
+ newpsl->sl_max = psl->sl_count - 1;
+ newpsl->sl_count = psl->sl_count - 1;
+ for (j = 0; j < i; j++)
+ newpsl->sl_addr[j] = psl->sl_addr[j];
+ for (j = i + 1; j < psl->sl_count; j++)
+ newpsl->sl_addr[j - 1] = psl->sl_addr[j];
+ }
+
/* update the interface filter */
ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
&mreqs->imr_sourceaddr, 1);
-
- for (j = i+1; j < psl->sl_count; j++)
- psl->sl_addr[j-1] = psl->sl_addr[j];
- psl->sl_count--;
+
+ rcu_assign_pointer(pmc->sflist, newpsl);
+ kfree_rcu(psl, rcu);
err = 0;
goto done;
}
@@ -2570,49 +2591,51 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
err = -ENOBUFS;
goto done;
}
- if (!psl || psl->sl_count == psl->sl_max) {
- struct ip_sf_socklist *newpsl;
- int count = IP_SFBLOCK;
- if (psl)
- count += psl->sl_max;
- newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),
- GFP_KERNEL);
- if (!newpsl) {
- err = -ENOBUFS;
- goto done;
- }
- newpsl->sl_max = count;
- newpsl->sl_count = count - IP_SFBLOCK;
- if (psl) {
- for (i = 0; i < psl->sl_count; i++)
- newpsl->sl_addr[i] = psl->sl_addr[i];
- /* decrease mem now to avoid the memleak warning */
- atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
- &sk->sk_omem_alloc);
+ rv = 1;
+ if (psl) {
+ for (i = 0; i < psl->sl_count; i++) {
+ rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
+ sizeof(__be32));
+ if (rv == 0)
+ break;
}
- rcu_assign_pointer(pmc->sflist, newpsl);
- if (psl)
- kfree_rcu(psl, rcu);
- psl = newpsl;
- }
- rv = 1; /* > 0 for insert logic below if sl_count is 0 */
- for (i = 0; i < psl->sl_count; i++) {
- rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
- sizeof(__be32));
- if (rv == 0)
- break;
- }
+
if (rv == 0) /* address already there is an error */
goto done;
- for (j = psl->sl_count-1; j >= i; j--)
- psl->sl_addr[j+1] = psl->sl_addr[j];
- psl->sl_addr[i] = mreqs->imr_sourceaddr;
- psl->sl_count++;
- err = 0;
+
+ i = psl ? psl->sl_count + 1 : 1;
+ count = IP_SFBLOCK;
+ if (psl)
+ count += psl->sl_max;
+ newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),
+ GFP_KERNEL);
+ if (!newpsl) {
+ err = -ENOBUFS;
+ goto done;
+ }
+ newpsl->sl_max = count;
+ newpsl->sl_count = i;
+ if (psl) {
+ for (j = 0; j < psl->sl_count; j++)
+ newpsl->sl_addr[j] = psl->sl_addr[j];
+ }
+ newpsl->sl_addr[i - 1] = mreqs->imr_sourceaddr;
+
/* update the interface list */
ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
&mreqs->imr_sourceaddr, 1);
+
+ if (psl) {
+ /* decrease mem now to avoid the memleak warning */
+ atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
+ &sk->sk_omem_alloc);
+ }
+ rcu_assign_pointer(pmc->sflist, newpsl);
+ if (psl)
+ kfree_rcu(psl, rcu);
+ err = 0;
+
done:
if (leavegroup)
err = ip_mc_leave_group(sk, &imr);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
2026-11-02 9:53 [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source() Binbin Deng
@ 2026-11-02 9:59 ` netdev-bot+sinfo
2026-11-02 15:59 ` kernel test robot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: netdev-bot+sinfo @ 2026-11-02 9:59 UTC (permalink / raw)
To: Binbin Deng
Cc: dsahern, idosch, davem, edumazet, kuba, pabeni, horms, netdev,
linux-kernel
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
2026-11-02 9:53 [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source() Binbin Deng
2026-11-02 9:59 ` netdev-bot+sinfo
@ 2026-11-02 15:59 ` kernel test robot
2026-11-02 17:49 ` kernel test robot
2026-11-02 18:10 ` kernel test robot
3 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2026-11-02 15:59 UTC (permalink / raw)
To: Binbin Deng, dsahern, idosch, davem, edumazet, kuba, pabeni, horms
Cc: oe-kbuild-all, netdev, linux-kernel, Binbin Deng
Hi Binbin,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Binbin-Deng/igmp-use-copy-on-write-RCU-updates-in-ip_mc_source/20261102-175312
base: net/main
patch link: https://lore.kernel.org/r/20261102095312.47767-1-18983559317%40163.com
patch subject: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
config: nios2-defconfig (https://download.01.org/0day-ci/archive/20261102/202611022340.iFWNzlRb-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261102/202611022340.iFWNzlRb-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611022340.iFWNzlRb-lkp@intel.com/
All warnings (new ones prefixed by >>):
net/ipv4/igmp.c: In function 'ip_mc_source':
net/ipv4/igmp.c:2976:34: error: invalid storage class for function 'igmp_mc_get_first'
2976 | static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:2998:27: error: invalid storage class for function 'igmp_mc_get_next'
2998 | static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3017:27: error: invalid storage class for function 'igmp_mc_get_idx'
3017 | static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
| ^~~~~~~~~~~~~~~
net/ipv4/igmp.c:3026:14: error: invalid storage class for function 'igmp_mc_seq_start'
3026 | static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3033:14: error: invalid storage class for function 'igmp_mc_seq_next'
3033 | static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3044:13: error: invalid storage class for function 'igmp_mc_seq_stop'
3044 | static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3054:12: error: invalid storage class for function 'igmp_mc_seq_show'
3054 | static int igmp_mc_seq_show(struct seq_file *seq, void *v)
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3094:25: error: initializer element is not constant
3094 | .start = igmp_mc_seq_start,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3094:25: note: (near initialization for 'igmp_mc_seq_ops.start')
net/ipv4/igmp.c:3095:25: error: initializer element is not constant
3095 | .next = igmp_mc_seq_next,
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3095:25: note: (near initialization for 'igmp_mc_seq_ops.next')
net/ipv4/igmp.c:3096:25: error: initializer element is not constant
3096 | .stop = igmp_mc_seq_stop,
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3096:25: note: (near initialization for 'igmp_mc_seq_ops.stop')
net/ipv4/igmp.c:3097:25: error: initializer element is not constant
3097 | .show = igmp_mc_seq_show,
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3097:25: note: (near initialization for 'igmp_mc_seq_ops.show')
net/ipv4/igmp.c:3109:34: error: invalid storage class for function 'igmp_mcf_get_first'
3109 | static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
| ^~~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3138:27: error: invalid storage class for function 'igmp_mcf_get_next'
3138 | static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_list *psf)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3164:27: error: invalid storage class for function 'igmp_mcf_get_idx'
3164 | static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
| ^~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3173:14: error: invalid storage class for function 'igmp_mcf_seq_start'
3173 | static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
| ^~~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3180:14: error: invalid storage class for function 'igmp_mcf_seq_next'
3180 | static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3191:13: error: invalid storage class for function 'igmp_mcf_seq_stop'
3191 | static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3204:12: error: invalid storage class for function 'igmp_mcf_seq_show'
3204 | static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3225:25: error: initializer element is not constant
3225 | .start = igmp_mcf_seq_start,
| ^~~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3225:25: note: (near initialization for 'igmp_mcf_seq_ops.start')
net/ipv4/igmp.c:3226:25: error: initializer element is not constant
3226 | .next = igmp_mcf_seq_next,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3226:25: note: (near initialization for 'igmp_mcf_seq_ops.next')
net/ipv4/igmp.c:3227:25: error: initializer element is not constant
3227 | .stop = igmp_mcf_seq_stop,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3227:25: note: (near initialization for 'igmp_mcf_seq_ops.stop')
net/ipv4/igmp.c:3228:25: error: initializer element is not constant
3228 | .show = igmp_mcf_seq_show,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3228:25: note: (near initialization for 'igmp_mcf_seq_ops.show')
net/ipv4/igmp.c:3231:23: error: invalid storage class for function 'igmp_net_init'
3231 | static int __net_init igmp_net_init(struct net *net)
| ^~~~~~~~~~~~~
net/ipv4/igmp.c:3262:24: error: invalid storage class for function 'igmp_net_exit'
3262 | static void __net_exit igmp_net_exit(struct net *net)
| ^~~~~~~~~~~~~
net/ipv4/igmp.c:3270:17: error: initializer element is not constant
3270 | .init = igmp_net_init,
| ^~~~~~~~~~~~~
net/ipv4/igmp.c:3270:17: note: (near initialization for 'igmp_net_ops.init')
net/ipv4/igmp.c:3271:17: error: initializer element is not constant
3271 | .exit = igmp_net_exit,
| ^~~~~~~~~~~~~
net/ipv4/igmp.c:3271:17: note: (near initialization for 'igmp_net_ops.exit')
net/ipv4/igmp.c:3275:12: error: invalid storage class for function 'igmp_netdev_event'
3275 | static int igmp_netdev_event(struct notifier_block *this,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3294:26: error: initializer element is not constant
3294 | .notifier_call = igmp_netdev_event,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3294:26: note: (near initialization for 'igmp_notifier.notifier_call')
net/ipv4/igmp.c:3316:1: error: expected declaration or statement at end of input
3316 | }
| ^
>> net/ipv4/igmp.c:3317: warning: control reaches end of non-void function [-Wreturn-type]
At top level:
>> net/ipv4/igmp.c:3297:12: warning: 'igmp_mc_init' defined but not used [-Wunused-function]
3297 | int __init igmp_mc_init(void)
| ^~~~~~~~~~~~
>> net/ipv4/igmp.c:2923:5: warning: 'ip_check_mc_rcu' defined but not used [-Wunused-function]
2923 | int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u8 proto)
| ^~~~~~~~~~~~~~~
>> net/ipv4/igmp.c:2897:6: warning: 'ip_mc_drop_socket' defined but not used [-Wunused-function]
2897 | void ip_mc_drop_socket(struct sock *sk)
| ^~~~~~~~~~~~~~~~~
>> net/ipv4/igmp.c:2849:5: warning: 'ip_mc_sf_allow' defined but not used [-Wunused-function]
2849 | int ip_mc_sf_allow(const struct sock *sk, __be32 loc_addr, __be32 rmt_addr,
| ^~~~~~~~~~~~~~
>> net/ipv4/igmp.c:2800:5: warning: 'ip_mc_gsfget' defined but not used [-Wunused-function]
2800 | int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
| ^~~~~~~~~~~~
>> net/ipv4/igmp.c:2736:5: warning: 'ip_mc_msfget' defined but not used [-Wunused-function]
2736 | int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf, sockopt_t *opt)
| ^~~~~~~~~~~~
>> net/ipv4/igmp.c:2645:5: warning: 'ip_mc_msfilter' defined but not used [-Wunused-function]
2645 | int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
| ^~~~~~~~~~~~~~
vim +3317 net/ipv4/igmp.c
4aa5dee4d99978 Jiri Pirko 2013-07-20 3292
4aa5dee4d99978 Jiri Pirko 2013-07-20 3293 static struct notifier_block igmp_notifier = {
4aa5dee4d99978 Jiri Pirko 2013-07-20 @3294 .notifier_call = igmp_netdev_event,
4aa5dee4d99978 Jiri Pirko 2013-07-20 3295 };
4aa5dee4d99978 Jiri Pirko 2013-07-20 3296
72c1d3bdd5bf10 WANG Cong 2014-01-10 @3297 int __init igmp_mc_init(void)
7091e728c57015 Alexey Dobriyan 2008-12-25 3298 {
72c1d3bdd5bf10 WANG Cong 2014-01-10 3299 #if defined(CONFIG_PROC_FS)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3300 int err;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3301
4aa5dee4d99978 Jiri Pirko 2013-07-20 3302 err = register_pernet_subsys(&igmp_net_ops);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3303 if (err)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3304 return err;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3305 err = register_netdevice_notifier(&igmp_notifier);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3306 if (err)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3307 goto reg_notif_fail;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3308 return 0;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3309
4aa5dee4d99978 Jiri Pirko 2013-07-20 3310 reg_notif_fail:
4aa5dee4d99978 Jiri Pirko 2013-07-20 3311 unregister_pernet_subsys(&igmp_net_ops);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3312 return err;
72c1d3bdd5bf10 WANG Cong 2014-01-10 3313 #else
72c1d3bdd5bf10 WANG Cong 2014-01-10 3314 return register_netdevice_notifier(&igmp_notifier);
^1da177e4c3f41 Linus Torvalds 2005-04-16 3315 #endif
72c1d3bdd5bf10 WANG Cong 2014-01-10 3316 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
2026-11-02 9:53 [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source() Binbin Deng
2026-11-02 9:59 ` netdev-bot+sinfo
2026-11-02 15:59 ` kernel test robot
@ 2026-11-02 17:49 ` kernel test robot
2026-11-02 18:10 ` kernel test robot
3 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2026-11-02 17:49 UTC (permalink / raw)
To: Binbin Deng, dsahern, idosch, davem, edumazet, kuba, pabeni, horms
Cc: llvm, oe-kbuild-all, netdev, linux-kernel, Binbin Deng
Hi Binbin,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Binbin-Deng/igmp-use-copy-on-write-RCU-updates-in-ip_mc_source/20261102-175312
base: net/main
patch link: https://lore.kernel.org/r/20261102095312.47767-1-18983559317%40163.com
patch subject: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
config: hexagon-defconfig (https://download.01.org/0day-ci/archive/20261103/202611030103.U23Q9Kyn-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 65303e81f481bbfe386b8596423f94c43198ba94)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261103/202611030103.U23Q9Kyn-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611030103.U23Q9Kyn-lkp@intel.com/
All errors (new ones prefixed by >>):
net/ipv4/igmp.c:2084:6: warning: variable 'changerec' set but not used [-Wunused-but-set-variable]
2084 | int changerec = 0;
| ^
>> net/ipv4/igmp.c:2646:1: error: function definition is not allowed here
2646 | {
| ^
net/ipv4/igmp.c:2737:1: error: function definition is not allowed here
2737 | {
| ^
net/ipv4/igmp.c:2802:1: error: function definition is not allowed here
2802 | {
| ^
net/ipv4/igmp.c:2851:1: error: function definition is not allowed here
2851 | {
| ^
net/ipv4/igmp.c:2898:1: error: function definition is not allowed here
2898 | {
| ^
net/ipv4/igmp.c:2924:1: error: function definition is not allowed here
2924 | {
| ^
net/ipv4/igmp.c:2977:1: error: function definition is not allowed here
2977 | {
| ^
net/ipv4/igmp.c:2999:1: error: function definition is not allowed here
2999 | {
| ^
net/ipv4/igmp.c:3018:1: error: function definition is not allowed here
3018 | {
| ^
net/ipv4/igmp.c:3028:1: error: function definition is not allowed here
3028 | {
| ^
net/ipv4/igmp.c:3034:1: error: function definition is not allowed here
3034 | {
| ^
net/ipv4/igmp.c:3046:1: error: function definition is not allowed here
3046 | {
| ^
net/ipv4/igmp.c:3055:1: error: function definition is not allowed here
3055 | {
| ^
>> net/ipv4/igmp.c:3094:11: error: use of undeclared identifier 'igmp_mc_seq_start'; did you mean 'igmp_mc_seq_ops'?
3094 | .start = igmp_mc_seq_start,
| ^~~~~~~~~~~~~~~~~
| igmp_mc_seq_ops
net/ipv4/igmp.c:3093:36: note: 'igmp_mc_seq_ops' declared here
3093 | static const struct seq_operations igmp_mc_seq_ops = {
| ^
>> net/ipv4/igmp.c:3095:10: error: use of undeclared identifier 'igmp_mc_seq_next'; did you mean 'igmp_mc_seq_ops'?
3095 | .next = igmp_mc_seq_next,
| ^~~~~~~~~~~~~~~~
| igmp_mc_seq_ops
net/ipv4/igmp.c:3093:36: note: 'igmp_mc_seq_ops' declared here
3093 | static const struct seq_operations igmp_mc_seq_ops = {
| ^
>> net/ipv4/igmp.c:3096:10: error: use of undeclared identifier 'igmp_mc_seq_stop'; did you mean 'igmp_mc_seq_ops'?
3096 | .stop = igmp_mc_seq_stop,
| ^~~~~~~~~~~~~~~~
| igmp_mc_seq_ops
net/ipv4/igmp.c:3093:36: note: 'igmp_mc_seq_ops' declared here
3093 | static const struct seq_operations igmp_mc_seq_ops = {
| ^
>> net/ipv4/igmp.c:3097:10: error: use of undeclared identifier 'igmp_mc_seq_show'; did you mean 'igmp_mc_seq_ops'?
3097 | .show = igmp_mc_seq_show,
| ^~~~~~~~~~~~~~~~
| igmp_mc_seq_ops
net/ipv4/igmp.c:3093:36: note: 'igmp_mc_seq_ops' declared here
3093 | static const struct seq_operations igmp_mc_seq_ops = {
| ^
>> net/ipv4/igmp.c:3094:11: error: initializing 'void *(*)(struct seq_file *, loff_t *)' (aka 'void *(*)(struct seq_file *, long long *)') with an expression of incompatible type 'const struct seq_operations'
3094 | .start = igmp_mc_seq_start,
| ^~~~~~~~~~~~~~~~~
>> net/ipv4/igmp.c:3095:10: error: initializing 'void *(*)(struct seq_file *, void *, loff_t *)' (aka 'void *(*)(struct seq_file *, void *, long long *)') with an expression of incompatible type 'const struct seq_operations'
3095 | .next = igmp_mc_seq_next,
| ^~~~~~~~~~~~~~~~
fatal error: too many errors emitted, stopping now [-ferror-limit=]
1 warning and 20 errors generated.
vim +2646 net/ipv4/igmp.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 2644
^1da177e4c3f41 Linus Torvalds 2005-04-16 2645 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
^1da177e4c3f41 Linus Torvalds 2005-04-16 @2646 {
9951f036fe8a4e David L Stevens 2005-07-08 2647 int err = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2648 struct ip_mreqn imr;
63007727e0bb09 Al Viro 2006-09-27 2649 __be32 addr = msf->imsf_multiaddr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2650 struct ip_mc_socklist *pmc;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2651 struct in_device *in_dev;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2652 struct inet_sock *inet = inet_sk(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2653 struct ip_sf_socklist *newpsl, *psl;
877acedc0d3ea0 Daniel Lezcano 2008-08-13 2654 struct net *net = sock_net(sk);
9951f036fe8a4e David L Stevens 2005-07-08 2655 int leavegroup = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2656
f97c1e0c6ebdb6 Joe Perches 2007-12-16 2657 if (!ipv4_is_multicast(addr))
^1da177e4c3f41 Linus Torvalds 2005-04-16 2658 return -EINVAL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2659 if (msf->imsf_fmode != MCAST_INCLUDE &&
^1da177e4c3f41 Linus Torvalds 2005-04-16 2660 msf->imsf_fmode != MCAST_EXCLUDE)
^1da177e4c3f41 Linus Torvalds 2005-04-16 2661 return -EINVAL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2662
54ff9ef36bdf84 Marcelo Ricardo Leitner 2015-03-18 2663 ASSERT_RTNL();
^1da177e4c3f41 Linus Torvalds 2005-04-16 2664
^1da177e4c3f41 Linus Torvalds 2005-04-16 2665 imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2666 imr.imr_address.s_addr = msf->imsf_interface;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2667 imr.imr_ifindex = ifindex;
877acedc0d3ea0 Daniel Lezcano 2008-08-13 2668 in_dev = ip_mc_find_dev(net, &imr);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2669
^1da177e4c3f41 Linus Torvalds 2005-04-16 2670 if (!in_dev) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2671 err = -ENODEV;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2672 goto done;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2673 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 2674
9951f036fe8a4e David L Stevens 2005-07-08 2675 /* special case - (INCLUDE, empty) == LEAVE_GROUP */
9951f036fe8a4e David L Stevens 2005-07-08 2676 if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
9951f036fe8a4e David L Stevens 2005-07-08 2677 leavegroup = 1;
9951f036fe8a4e David L Stevens 2005-07-08 2678 goto done;
9951f036fe8a4e David L Stevens 2005-07-08 2679 }
9951f036fe8a4e David L Stevens 2005-07-08 2680
1d7138de878d1d Eric Dumazet 2010-11-12 2681 for_each_pmc_rtnl(inet, pmc) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2682 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
^1da177e4c3f41 Linus Torvalds 2005-04-16 2683 pmc->multi.imr_ifindex == imr.imr_ifindex)
^1da177e4c3f41 Linus Torvalds 2005-04-16 2684 break;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2685 }
917f2f105ea4bb David L Stevens 2005-07-08 2686 if (!pmc) { /* must have a prior join */
917f2f105ea4bb David L Stevens 2005-07-08 2687 err = -EINVAL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2688 goto done;
917f2f105ea4bb David L Stevens 2005-07-08 2689 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 2690 if (msf->imsf_numsrc) {
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2691 newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr,
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2692 msf->imsf_numsrc),
8b3a70058bfe71 Kris Katterjohn 2006-01-11 2693 GFP_KERNEL);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2694 if (!newpsl) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2695 err = -ENOBUFS;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2696 goto done;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2697 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 2698 newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
2d3e5caf96b944 Gustavo A. R. Silva 2021-07-31 2699 memcpy(newpsl->sl_addr, msf->imsf_slist_flex,
2d3e5caf96b944 Gustavo A. R. Silva 2021-07-31 2700 flex_array_size(msf, imsf_slist_flex, msf->imsf_numsrc));
^1da177e4c3f41 Linus Torvalds 2005-04-16 2701 err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
^1da177e4c3f41 Linus Torvalds 2005-04-16 2702 msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2703 if (err) {
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2704 sock_kfree_s(sk, newpsl,
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2705 struct_size(newpsl, sl_addr,
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2706 newpsl->sl_max));
^1da177e4c3f41 Linus Torvalds 2005-04-16 2707 goto done;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2708 }
8713dbf05754aa Yan Zheng 2005-10-28 2709 } else {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2710 newpsl = NULL;
8713dbf05754aa Yan Zheng 2005-10-28 2711 (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
8713dbf05754aa Yan Zheng 2005-10-28 2712 msf->imsf_fmode, 0, NULL, 0);
8713dbf05754aa Yan Zheng 2005-10-28 2713 }
1d7138de878d1d Eric Dumazet 2010-11-12 2714 psl = rtnl_dereference(pmc->sflist);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2715 if (psl) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2716 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
^1da177e4c3f41 Linus Torvalds 2005-04-16 2717 psl->sl_count, psl->sl_addr, 0);
c85bb41e93184b Flavio Leitner 2010-02-02 2718 /* decrease mem now to avoid the memleak warning */
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2719 atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
e6a1f7e0b0fe59 Gustavo A. R. Silva 2021-08-04 2720 &sk->sk_omem_alloc);
dba5bdd57bea58 Eric Dumazet 2022-04-29 2721 } else {
^1da177e4c3f41 Linus Torvalds 2005-04-16 2722 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
^1da177e4c3f41 Linus Torvalds 2005-04-16 2723 0, NULL, 0);
dba5bdd57bea58 Eric Dumazet 2022-04-29 2724 }
cf778b00e96df6 Eric Dumazet 2012-01-12 2725 rcu_assign_pointer(pmc->sflist, newpsl);
dba5bdd57bea58 Eric Dumazet 2022-04-29 2726 if (psl)
dba5bdd57bea58 Eric Dumazet 2022-04-29 2727 kfree_rcu(psl, rcu);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2728 pmc->sfmode = msf->imsf_fmode;
917f2f105ea4bb David L Stevens 2005-07-08 2729 err = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2730 done:
9951f036fe8a4e David L Stevens 2005-07-08 2731 if (leavegroup)
9951f036fe8a4e David L Stevens 2005-07-08 2732 err = ip_mc_leave_group(sk, &imr);
^1da177e4c3f41 Linus Torvalds 2005-04-16 2733 return err;
^1da177e4c3f41 Linus Torvalds 2005-04-16 2734 }
e12e04f5ab54cd Breno Leitao 2026-09-14 2735
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
2026-11-02 9:53 [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source() Binbin Deng
` (2 preceding siblings ...)
2026-11-02 17:49 ` kernel test robot
@ 2026-11-02 18:10 ` kernel test robot
3 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2026-11-02 18:10 UTC (permalink / raw)
To: Binbin Deng, dsahern, idosch, davem, edumazet, kuba, pabeni, horms
Cc: llvm, oe-kbuild-all, netdev, linux-kernel, Binbin Deng
Hi Binbin,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Binbin-Deng/igmp-use-copy-on-write-RCU-updates-in-ip_mc_source/20261102-175312
base: net/main
patch link: https://lore.kernel.org/r/20261102095312.47767-1-18983559317%40163.com
patch subject: [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source()
config: sparc64-randconfig-1001-20261102 (https://download.01.org/0day-ci/archive/20261103/202611030211.aklzSdgm-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261103/202611030211.aklzSdgm-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611030211.aklzSdgm-lkp@intel.com/
All errors (new ones prefixed by >>):
net/ipv4/igmp.c:2646:1: error: function definition is not allowed here
2646 | {
| ^
net/ipv4/igmp.c:2737:1: error: function definition is not allowed here
2737 | {
| ^
net/ipv4/igmp.c:2802:1: error: function definition is not allowed here
2802 | {
| ^
net/ipv4/igmp.c:2851:1: error: function definition is not allowed here
2851 | {
| ^
net/ipv4/igmp.c:2898:1: error: function definition is not allowed here
2898 | {
| ^
net/ipv4/igmp.c:2924:1: error: function definition is not allowed here
2924 | {
| ^
net/ipv4/igmp.c:3277:1: error: function definition is not allowed here
3277 | {
| ^
>> net/ipv4/igmp.c:3294:19: error: use of undeclared identifier 'igmp_netdev_event'; did you mean 'igmp_ifc_event'?
3294 | .notifier_call = igmp_netdev_event,
| ^~~~~~~~~~~~~~~~~
| igmp_ifc_event
net/ipv4/igmp.c:884:13: note: 'igmp_ifc_event' declared here
884 | static void igmp_ifc_event(struct in_device *in_dev)
| ^
>> net/ipv4/igmp.c:3294:19: error: incompatible function pointer types initializing 'notifier_fn_t' (aka 'int (*)(struct notifier_block *, unsigned long, void *)') with an expression of type 'void (struct in_device *)' [-Wincompatible-function-pointer-types]
3294 | .notifier_call = igmp_netdev_event,
| ^~~~~~~~~~~~~~~~~
net/ipv4/igmp.c:3298:1: error: function definition is not allowed here
3298 | {
| ^
>> net/ipv4/igmp.c:3316:2: error: expected '}'
3316 | }
| ^
net/ipv4/igmp.c:2485:1: note: to match this '{'
2485 | {
| ^
11 errors generated.
vim +3294 net/ipv4/igmp.c
4aa5dee4d99978 Jiri Pirko 2013-07-20 3292
4aa5dee4d99978 Jiri Pirko 2013-07-20 3293 static struct notifier_block igmp_notifier = {
4aa5dee4d99978 Jiri Pirko 2013-07-20 @3294 .notifier_call = igmp_netdev_event,
4aa5dee4d99978 Jiri Pirko 2013-07-20 3295 };
4aa5dee4d99978 Jiri Pirko 2013-07-20 3296
72c1d3bdd5bf10 WANG Cong 2014-01-10 3297 int __init igmp_mc_init(void)
7091e728c57015 Alexey Dobriyan 2008-12-25 3298 {
72c1d3bdd5bf10 WANG Cong 2014-01-10 3299 #if defined(CONFIG_PROC_FS)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3300 int err;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3301
4aa5dee4d99978 Jiri Pirko 2013-07-20 3302 err = register_pernet_subsys(&igmp_net_ops);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3303 if (err)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3304 return err;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3305 err = register_netdevice_notifier(&igmp_notifier);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3306 if (err)
4aa5dee4d99978 Jiri Pirko 2013-07-20 3307 goto reg_notif_fail;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3308 return 0;
4aa5dee4d99978 Jiri Pirko 2013-07-20 3309
4aa5dee4d99978 Jiri Pirko 2013-07-20 3310 reg_notif_fail:
4aa5dee4d99978 Jiri Pirko 2013-07-20 3311 unregister_pernet_subsys(&igmp_net_ops);
4aa5dee4d99978 Jiri Pirko 2013-07-20 3312 return err;
72c1d3bdd5bf10 WANG Cong 2014-01-10 3313 #else
72c1d3bdd5bf10 WANG Cong 2014-01-10 3314 return register_netdevice_notifier(&igmp_notifier);
^1da177e4c3f41 Linus Torvalds 2005-04-16 3315 #endif
72c1d3bdd5bf10 WANG Cong 2014-01-10 @3316 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-11-02 18:11 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-02 9:53 [PATCH net v1] igmp: use copy-on-write RCU updates in ip_mc_source() Binbin Deng
2026-11-02 9:59 ` netdev-bot+sinfo
2026-11-02 15:59 ` kernel test robot
2026-11-02 17:49 ` kernel test robot
2026-11-02 18:10 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®