From: Kuniyuki Iwashima <kuniyu@google.com>
To: Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: netdev@vger.kernel.org, stable@vger.kernel.org,
Fernando Fernandez Mancera <fmancera@suse.de>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
Shuah Khan <skhan@linuxfoundation.org>,
Randy Dunlap <rdunlap@infradead.org>,
David Ahern <dsahern@kernel.org>,
Ido Schimmel <idosch@nvidia.com>,
Thomas Gleixner <tglx@kernel.org>,
Joel Granados <joel.granados@kernel.org>,
Petr Pavlu <petr.pavlu@suse.com>,
Maoyi Xie <maoyi.xie@ntu.edu.sg>,
Gerd Rausch <gerd.rausch@oracle.com>,
Oleg Nesterov <oleg@redhat.com>,
Nikolay Aleksandrov <razor@blackwall.org>,
Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>,
Yung Chih Su <yuuchihsu@gmail.com>,
Wyatt Feng <bronzed_45_vested@icloud.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
Flavio Leitner <fbl@redhat.com>,
"Paul E. McKenney" <paulmck@kernel.org>,
Petr Mladek <pmladek@suse.com>,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net v3 3/5] ipv6: restrict mld_qrv to 255
Date: Tue, 3 Nov 2026 05:29:05 +0000 [thread overview]
Message-ID: <aulxGkfJ-7V8RUZp@google.com> (raw)
In-Reply-To: <20261101061331.286404-4-jiayuan.chen@linux.dev>
On Sun, 01 Nov 2026 14:12:01 +0800, Jiayuan Chen wrote:
> net.ipv6.mld_qrv only has a lower bound, but ipv6_mc_reset() stores it
> into the u8 inet6_dev::mc_qrv, so 256 wraps to 0 and the first MLDv2
> Query received on the interface trips the WARN_ON() in mld_update_qrv():
>
> WARN_ON(idev->mc_qrv == 0);
>
> WARNING: net/ipv6/mcast.c:1327 at mld_query_work+0x1fd2/0x2cb0, CPU#3: kworker/3:1/2688
> Workqueue: mld mld_query_work
> RIP: 0010:mld_query_work+0x1fd2/0x2cb0
> Call Trace:
> <TASK>
> process_one_work+0x93a/0x1b20
> worker_thread+0x6d0/0x11d0
> kthread+0x358/0x470
> ret_from_fork+0x5b3/0x820
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> Make the sysctl a u8 like mc_qrv and switch to proc_dou8vec_minmax(),
> which rejects anything above 255, and document it.
>
> Fixes: 2f711939d2ea ("ipv6: add sysctl_mld_qrv to configure query robustness variable")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
next prev parent reply other threads:[~2026-11-03 5:29 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-01 6:11 [PATCH net v3 0/5] net: fix misc signed overflows caused by bad sysctl values Jiayuan Chen
2026-11-01 6:11 ` [PATCH net v3 1/5] ipv6: restrict gc_elasticity to 31 Jiayuan Chen
2026-11-02 1:25 ` Hangbin Liu
2026-11-01 6:12 ` [PATCH net v3 2/5] ipv4: fix shift-out-of-bounds in ip_rt_send_redirect() Jiayuan Chen
2026-11-03 5:28 ` Kuniyuki Iwashima
2026-11-01 6:12 ` [PATCH net v3 3/5] ipv6: restrict mld_qrv to 255 Jiayuan Chen
2026-11-01 10:23 ` Nikolay Aleksandrov
2026-11-02 1:31 ` Hangbin Liu
2026-11-03 5:29 ` Kuniyuki Iwashima [this message]
2026-11-01 6:12 ` [PATCH net v3 4/5] ipv4: restrict igmp_qrv " Jiayuan Chen
2026-11-02 1:29 ` Hangbin Liu
2026-11-03 5:29 ` Kuniyuki Iwashima
2026-11-01 6:12 ` [PATCH net v3 5/5] net: restrict message_cost and message_burst to non-negative values Jiayuan Chen
2026-11-02 1:55 ` Hangbin Liu
2026-11-02 2:23 ` Jiayuan Chen
2026-11-02 3:32 ` Hangbin Liu
2026-11-03 5:30 ` Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aulxGkfJ-7V8RUZp@google.com \
--to=kuniyu@google.com \
--cc=bronzed_45_vested@icloud.com \
--cc=chia-yu.chang@nokia-bell-labs.com \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@kernel.org \
--cc=fbl@redhat.com \
--cc=fmancera@suse.de \
--cc=gerd.rausch@oracle.com \
--cc=hannes@stressinduktion.org \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=jiayuan.chen@linux.dev \
--cc=joel.granados@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maoyi.xie@ntu.edu.sg \
--cc=netdev@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=pabeni@redhat.com \
--cc=paulmck@kernel.org \
--cc=petr.pavlu@suse.com \
--cc=pmladek@suse.com \
--cc=razor@blackwall.org \
--cc=rdunlap@infradead.org \
--cc=skhan@linuxfoundation.org \
--cc=stable@vger.kernel.org \
--cc=tglx@kernel.org \
--cc=yuuchihsu@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.