Re: [PATCH net 3/5] ipv6: restrict mld_qrv to 255

[Kuniyuki Iwashima <kuniyu@google.com>]

On Fri, 23 Oct 2026 17:13:29 +0800, Jiayuan Chen wrote:
> net.ipv6.mld_qrv only has a lower bound, but ipv6_mc_reset() stores it
> into the u8 inet6_dev::mc_qrv, and every MLD retransmit counter derived
> from it (mca_crcount, sf_crcount, mc_ifc_count, mc_dad_count) is u8 as
> well. Anything above 255 silently wraps: 256 becomes 0, so no state
> change report is ever retransmitted, and the first MLDv2 Query received
> on the interface then trips the WARN_ON() in mld_update_qrv():
> 
> 	WARN_ON(idev->mc_qrv == 0);
> 
> A plain bridge with mcast_querier enabled on the link is enough:
> 
>   WARNING: net/ipv6/mcast.c:1327 at mld_query_work+0x1fd2/0x2cb0, CPU#3: kworker/3:1/2688
>   Workqueue: mld mld_query_work
>   RIP: 0010:mld_query_work+0x1fd2/0x2cb0
>   Call Trace:
>    <TASK>
>    process_one_work+0x93a/0x1b20
>    worker_thread+0x6d0/0x11d0
>    kthread+0x358/0x470
>    ret_from_fork+0x5b3/0x820
>    ret_from_fork_asm+0x1a/0x30
>    </TASK>
> 
> Cap the sysctl at U8_MAX, the largest value mc_qrv can actually hold.
> 
> Fixes: 2f711939d2ea ("ipv6: add sysctl_mld_qrv to configure query robustness variable")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  net/ipv6/sysctl_net_ipv6.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
> index 1a0a36dcdabc..05a384680332 100644
> --- a/net/ipv6/sysctl_net_ipv6.c
> +++ b/net/ipv6/sysctl_net_ipv6.c
> @@ -29,6 +29,7 @@ static u32 rt6_multipath_hash_fields_all_mask =
>  	FIB_MULTIPATH_HASH_FIELD_ALL_MASK;
>  static u32 ioam6_id_max = IOAM6_DEFAULT_ID;
>  static u64 ioam6_id_wide_max = IOAM6_DEFAULT_ID_WIDE;
> +static int mld_qrv_max = U8_MAX;
>  
>  static int proc_rt6_multipath_hash_policy(const struct ctl_table *table, int write,
>  					  void *buffer, size_t *lenp, loff_t *ppos)
> @@ -229,7 +230,8 @@ static struct ctl_table ipv6_rotable[] = {
>  		.maxlen		= sizeof(int),
>  		.mode		= 0644,
>  		.proc_handler	= proc_dointvec_minmax,

inet6_dev.mc_qrv is u8, you can simply use proc_dou8vec_minmax()
instead of adding extra2.


> -		.extra1		= SYSCTL_ONE
> +		.extra1		= SYSCTL_ONE,
> +		.extra2		= &mld_qrv_max,
>  	},
>  #ifdef CONFIG_NETLABEL
>  	{
> -- 
> 2.43.0
>