[PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[Cheng Yongkang <teel4res@gmail.com>]

__eht_del_set_entry() decrements eht_host->num_entries only when the set
entry's host address is non-zero.  A report sent from the unspecified
source address 0.0.0.0 (or in6addr_any for MLDv2) creates an EHT host
with h_addr == 0, while the set entries created for its sources have
non-zero source addresses and are counted against PG_SRC_ENT_LIMIT.
Deleting those sources never releases the host's budget; after 32 counted
sources the host stays at num_entries == 32 and every later counted set
entry is refused.  The same sequence with a non-zero report source
releases the budget normally:

  host 0.0.0.0:  IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/32
  host 10.9.9.9: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/0

Only set entries created for a non-zero source address are counted:
br_multicast_create_eht_set_entry() rejects a zero source when
allow_zero_src is false, and __eht_lookup_create_set_entry() increments
num_entries only for those entries.  The auto-created wildcard entry for
a zero host uses allow_zero_src == true and is not counted.  Release the
budget based on eht_set->src_addr instead of h_addr, so counted entries
decrement for zero-address hosts as well.  The uncounted wildcard entry
no longer decrements the counter, which also removes the converse
mismatch for non-zero hosts.

Fixes: baa74d39ca39 ("net: bridge: multicast: add EHT source set handling functions")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 net/bridge/br_multicast_eht.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c
index 18eaf9c..548ad78 100644
--- a/net/bridge/br_multicast_eht.c
+++ b/net/bridge/br_multicast_eht.c
@@ -167,7 +167,14 @@ static void __eht_del_set_entry(struct net_bridge_group_eht_set_entry *set_h)
 	RB_CLEAR_NODE(&set_h->rb_node);
 	hlist_del_init(&set_h->host_list);
 	memset(&zero_addr, 0, sizeof(zero_addr));
-	if (memcmp(&set_h->h_addr, &zero_addr, sizeof(zero_addr)))
+	/* Only set entries created for a non-zero source address are counted
+	 * towards the host's budget, the auto-created zero source entry is
+	 * not (see __eht_lookup_create_set_entry()).  Check the set's source
+	 * address and not the host address: the host address can be zero as
+	 * well (IGMPv3/MLDv2 allow an unspecified report source address), but
+	 * its real source entries are still counted.
+	 */
+	if (memcmp(&set_h->eht_set->src_addr, &zero_addr, sizeof(zero_addr)))
 		eht_host->num_entries--;
 	hlist_add_head(&set_h->mcast_gc.gc_node, &set_h->br->mcast_gc_list);
 	queue_work(system_long_wq, &set_h->br->mcast_gc_work);
-- 
2.34.1