Re: [PATCH net] ipv4: igmp: report interface group allocation failure on join

[Ido Schimmel]

On Thu, Oct 22, 2026 at 02:23:59AM +0900, Tianyi Chen wrote:
> setsockopt(IP_ADD_MEMBERSHIP) can return 0 while the group was never
> joined on the interface.  __ip_mc_join_group() publishes the socket-side
> ip_mc_socklist in inet->mc_list before calling ____ip_mc_inc_group().
> That helper returns void, so when its kzalloc_obj() fails it returns
> without creating the interface-side ip_mc_list and the syscall still
> reports success.  The socket then passes IP_MSFILTER but cannot receive
> the group's traffic: no IGMP report is generated, the group is absent
> from /proc/net/igmp, and the receive path drops the datagrams.  Closing
> the socket also decrements the interface group for every published
> ip_mc_socklist, so it can remove a group that another socket joined.
> 
> Make the helper return -ENOBUFS on allocation failure, call it before
> publishing iml, and free iml on failure.  The object is charged with
> sock_kmalloc(), so sock_kfree_s() with the same size keeps
> sk_omem_alloc balanced; it was never published and has no source list
> yet, so no RCU free is needed.  Successful joins still publish the fully
> initialized socket-side record after the interface group exists.  RTNL
> serializes the writers, not the RCU readers; this ordering prevents a
> published socket membership without a device group.
> 
> The legacy void wrapper keeps its best-effort behaviour: interface-up,
> init, bridge and tunnel callers cannot report an allocation failure.  A
> query does not recreate a missing group; only a later successful
> inc_group call can.  The silent failure predates the 2019 helper split
> (9fb20801dab4); there is no recent regression to tag with Fixes.
> 
> Reproduced with fail-nth on v6.19 and v7.3-rc2.  N=2 fails the helper's
> kzalloc_obj(): the original returns 0 with no interface group and 0/4
> multicast datagrams delivered; this change returns -ENOBUFS, leaves no
> socket or interface state, and a later join delivers 2/2.  On the
> original, closing the half-joined socket also removes a second socket's
> group; the patched kernel keeps it.  Normal joins, the existing-group
> users++ path and source-specific joins (allowed 2/2, filtered 0/2) are
> unchanged.
> 
> Assisted-by: LLM
> Signed-off-by: Tianyi Chen <hi@xxxxxxxxx>
> ---
>  net/ipv4/igmp.c | 37 ++++++++++++++++++++++++++++---------
>  1 file changed, 28 insertions(+), 9 deletions(-)

Looks like unnecessary churn. The failure is not realistic.