Re: [PATCH net v3 4/5] ipv4: restrict igmp_qrv to 255

[Hangbin Liu <hangbin.liu@linux.dev>]

On Sun, Nov 01, 2026 at 02:12:02PM +0800, Jiayuan Chen wrote:
> net.ipv4.igmp_qrv only has a lower bound, but ip_mc_reset() stores it
> into the u8 in_device::mr_qrv, and the IGMPv3 retransmit counters filled
> from it (crcount, sf_crcount) are u8 as well. Anything above 255
> silently wraps. With 256, mr_qrv becomes 0, every
> "in_dev->mr_qrv ?: sysctl_igmp_qrv" falls back to 256, which truncates
> to 0 again in crcount, and igmpv3_send_cr() never puts the state change
> records for the group into a report. The older version querier present
> timeout (mr_qrv * mr_qi + mr_qri) also collapses to just mr_qri.
> 
> Make the sysctl a u8 like mr_qrv and switch to proc_dou8vec_minmax(),
> which rejects anything above 255, and document it.
> 
> Fixes: a9fe8e29945d ("ipv4: implement igmp_qrv sysctl to tune igmp robustness variable")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> For AI review: drivers/net/amt.c writing sysctl_igmp_qrv into the 3-bit
> qrv wire fields is pre-existing and out of scope for this patch.
> 
> v2: switched to u8 and proc_dou8vec_minmax(), as suggested by Kuniyuki
> Iwashima.
> ---
>  Documentation/networking/ip-sysctl.rst                        | 2 ++
>  Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst | 2 +-
>  include/net/netns/ipv4.h                                      | 2 +-
>  net/ipv4/sysctl_net_ipv4.c                                    | 4 ++--
>  4 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
> index 71f334f27004e..9e282fb046904 100644
> --- a/Documentation/networking/ip-sysctl.rst
> +++ b/Documentation/networking/ip-sysctl.rst
> @@ -1906,6 +1906,8 @@ igmp_qrv - INTEGER
>  
>  	Minimum: 1 (as specified by RFC6636 4.5)
>  
> +	Maximum: 255
> +
>  force_igmp_version - INTEGER
>  	- 0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback
>  	  allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier
> diff --git a/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst b/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
> index 3dc03bff739e4..2833ce6cba1d4 100644
> --- a/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
> +++ b/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
> @@ -143,9 +143,9 @@ int                             sysctl_udp_rmem_min
>  u8                              sysctl_fib_notify_on_flag_change
>  u8                              sysctl_udp_l3mdev_accept
>  u8                              sysctl_igmp_llm_reports
> +u8                              sysctl_igmp_qrv
>  int                             sysctl_igmp_max_memberships
>  int                             sysctl_igmp_max_msf
> -int                             sysctl_igmp_qrv
>  struct_ping_group_range         ping_group_range
>  atomic_t                        dev_addr_genid
>  unsigned_int                    sysctl_udp_child_hash_entries
> diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> index cb7f8bf15671c..3efbc7f4b4f7d 100644
> --- a/include/net/netns/ipv4.h
> +++ b/include/net/netns/ipv4.h
> @@ -258,9 +258,9 @@ struct netns_ipv4 {
>  #endif
>  
>  	u8 sysctl_igmp_llm_reports;
> +	u8 sysctl_igmp_qrv;
>  	int sysctl_igmp_max_memberships;
>  	int sysctl_igmp_max_msf;
> -	int sysctl_igmp_qrv;
>  
>  	struct ping_group_range ping_group_range;
>  	u16			ping_port_rover;
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index e3760daa34706..09f7fc6771456 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -975,9 +975,9 @@ static const struct ctl_table ipv4_net_table[] = {
>  	{
>  		.procname	= "igmp_qrv",
>  		.data		= &init_net.ipv4.sysctl_igmp_qrv,
> -		.maxlen		= sizeof(int),
> +		.maxlen		= sizeof(u8),
>  		.mode		= 0644,
> -		.proc_handler	= proc_dointvec_minmax,
> +		.proc_handler	= proc_dou8vec_minmax,
>  		.extra1		= SYSCTL_ONE
>  	},
>  #endif
> -- 
> 2.43.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>