xen-netback: defer xenvif_mcast_addr_list_free()

In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).

Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().

This is XSA-527 / CVE-2026-100081.

Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt@proton.me>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>

0 files changed, 0 insertions, 0 deletions