From: Yue Haibing <yuehaibing@huawei.com>
Date: Mon, 14 Jul 2025 14:19:57 +0000 (+0800)
Subject: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
X-Git-Tag: v6.16-rc7~37^2~15
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ae3264a25a4635531264728859dbe9c659fad554;p=thirdparty%2Fkernel%2Flinux.git

ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
does, the reference should be put after ip6_mc_clear_src() return.

Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 65831b4fee1fd..616bf4c0c8fd9 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -807,8 +807,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 		} else {
 			im->mca_crcount = idev->mc_qrv;
 		}
-		in6_dev_put(pmc->idev);
 		ip6_mc_clear_src(pmc);
+		in6_dev_put(pmc->idev);
 		kfree_rcu(pmc, rcu);
 	}
 }