From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=95.215.58.69 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792746964; b=tBeK1h4xFImsACMkLHA1imuW52I9O+vmKCoRmZ53YA2eMBdd3R9DcskxAkJblrzKpe6+ a9zfGBIIfsfHiCDhbjBlkDoucWGOUFK57dwUi4cqQYOx9ctQXRQkGfy2nofhXjFK6yHkM JbtRm3kLonHmCOUtGZHu6uGUIytnJvP+YZVaAytQH01fFv8obU2pEG7QIeX+6XH+bdX4w KZEda0MNhk1A1UUGbzLbtLdDkn74Q6U3jMwtpQVi8VBPXv0qGK5QIU2DCtT6wFLUs1ykg 1f/eehpHwznUm9Us6NnJrEUlymARYjuxTrKoUT2VEU3KEwAdcIb1BT+MXwIFU3/BiJQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792746964; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=gQa3VPH3WC7Q6OeX84J4Qisj2fpU7RPLlHn2HbeI82U=; b=wazXeE4vbPB/HP2MWGJ3T2Mysj1EdEkx1nkHybcM1L10NkHt1/b/VigEpfqT9KBvt2QP aY9zSOk01Rnr6dxcuWvv98qmedix7CQvilglFHgcCUdEqUqo+hKJjwtJU13kYm9+WgZ5n jWFffXz6wmREN7fJmYiyRpfWHTZV+QAtDWMPQsDcj5tDAizwWKYg5OrZ3wie34Gq0wWOs JWM5s5lg27jC0BZ7NIms1wKkg8lQw4LGxrJSj6F/U2BT/HMPptDqxbonewXYYyQZ6TrlQ GRAEPvK6JEBsklURpR+grSMyKP3lfcdH6tY445F7a8W5lThQ16X5nCyCcLj/rJKT1mA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=YVMKHM67; arc=none smtp.remote-ip=95.215.58.69 Received: from mta1.migadu.com (out-69.mta1.migadu.com [95.215.58.69]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 71F53606A326 for ; Fri, 23 Oct 2026 09:16:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 71F53606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=YVMKHM67 X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=AXpBt4cHsmJnsrGVNmAyGambJ4dbgF80uBFZxZfStYY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1792746961; v=1; x=1793351761; b=YVMKHM67oBkq21ZxQ9lCVhFNPOfVj13dMAaMtxP/6qDup5nOQcW+SMWBGGKLAddRixqoc2Hr Ao5sWvrD5JRLkqZjR3TUs46e4GqbnLMMnot8UvfUPKqGNvtF+MQzggf+u/kChzey6os2ODLpDR1 9D3bdIAbJGTBzIqjJplRkZ8Q= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id b33d5272d189b10a; Fri, 23 Oct 2026 09:16:01 +0000 X-Mizu-Trace-ID: b33d5272d189b10a X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: netdev@vger.kernel.org Cc: Jiayuan Chen , stable@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , David Ahern , Ido Schimmel , Kuniyuki Iwashima , Neal Cardwell , Joel Granados , Chia-Yu Chang , Fernando Fernandez Mancera , Wyatt Feng , Yung Chih Su , Flavio Leitner , Hannes Frederic Sowa , "Paul E. McKenney" , Petr Mladek , linux-kernel@vger.kernel.org Subject: [PATCH net 3/5] ipv6: restrict mld_qrv to 255 Date: Fri, 23 Oct 2026 17:13:29 +0800 Message-ID: <20261023091419.167088-4-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261023091419.167088-1-jiayuan.chen@linux.dev> References: <20261023091419.167088-1-jiayuan.chen@linux.dev> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit net.ipv6.mld_qrv only has a lower bound, but ipv6_mc_reset() stores it into the u8 inet6_dev::mc_qrv, and every MLD retransmit counter derived from it (mca_crcount, sf_crcount, mc_ifc_count, mc_dad_count) is u8 as well. Anything above 255 silently wraps: 256 becomes 0, so no state change report is ever retransmitted, and the first MLDv2 Query received on the interface then trips the WARN_ON() in mld_update_qrv(): WARN_ON(idev->mc_qrv == 0); A plain bridge with mcast_querier enabled on the link is enough: WARNING: net/ipv6/mcast.c:1327 at mld_query_work+0x1fd2/0x2cb0, CPU#3: kworker/3:1/2688 Workqueue: mld mld_query_work RIP: 0010:mld_query_work+0x1fd2/0x2cb0 Call Trace: process_one_work+0x93a/0x1b20 worker_thread+0x6d0/0x11d0 kthread+0x358/0x470 ret_from_fork+0x5b3/0x820 ret_from_fork_asm+0x1a/0x30 Cap the sysctl at U8_MAX, the largest value mc_qrv can actually hold. Fixes: 2f711939d2ea ("ipv6: add sysctl_mld_qrv to configure query robustness variable") Cc: stable@vger.kernel.org Signed-off-by: Jiayuan Chen --- net/ipv6/sysctl_net_ipv6.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index 1a0a36dcdabc..05a384680332 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c @@ -29,6 +29,7 @@ static u32 rt6_multipath_hash_fields_all_mask = FIB_MULTIPATH_HASH_FIELD_ALL_MASK; static u32 ioam6_id_max = IOAM6_DEFAULT_ID; static u64 ioam6_id_wide_max = IOAM6_DEFAULT_ID_WIDE; +static int mld_qrv_max = U8_MAX; static int proc_rt6_multipath_hash_policy(const struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) @@ -229,7 +230,8 @@ static struct ctl_table ipv6_rotable[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_dointvec_minmax, - .extra1 = SYSCTL_ONE + .extra1 = SYSCTL_ONE, + .extra2 = &mld_qrv_max, }, #ifdef CONFIG_NETLABEL { -- 2.43.0