[PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[Cheng Yongkang]

__eht_del_set_entry() decrements eht_host->num_entries only when the set
entry's host address is non-zero.  A report sent from the unspecified
source address 0.0.0.0 (or in6addr_any for MLDv2) creates an EHT host
with h_addr == 0, while the set entries created for its sources have
non-zero source addresses and are counted against PG_SRC_ENT_LIMIT.
Deleting those sources never releases the host's budget; after 32 counted
sources the host stays at num_entries == 32 and every later counted set
entry is refused.  The same sequence with a non-zero report source
releases the budget normally:

  host 0.0.0.0:  IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/32
  host 10.9.9.9: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/0

Only set entries created for a non-zero source address are counted:
br_multicast_create_eht_set_entry() rejects a zero source when
allow_zero_src is false, and __eht_lookup_create_set_entry() increments
num_entries only for those entries.  The auto-created wildcard entry for
a zero host uses allow_zero_src == true and is not counted.  Release the
budget based on eht_set->src_addr instead of h_addr, so counted entries
decrement for zero-address hosts as well.  The uncounted wildcard entry
no longer decrements the counter, which also removes the converse
mismatch for non-zero hosts.

Fixes: baa74d39ca39 ("net: bridge: multicast: add EHT source set handling functions")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 net/bridge/br_multicast_eht.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c
index 18eaf9c..548ad78 100644
--- a/net/bridge/br_multicast_eht.c
+++ b/net/bridge/br_multicast_eht.c
@@ -167,7 +167,14 @@ static void __eht_del_set_entry(struct net_bridge_group_eht_set_entry *set_h)
 	RB_CLEAR_NODE(&set_h->rb_node);
 	hlist_del_init(&set_h->host_list);
 	memset(&zero_addr, 0, sizeof(zero_addr));
-	if (memcmp(&set_h->h_addr, &zero_addr, sizeof(zero_addr)))
+	/* Only set entries created for a non-zero source address are counted
+	 * towards the host's budget, the auto-created zero source entry is
+	 * not (see __eht_lookup_create_set_entry()).  Check the set's source
+	 * address and not the host address: the host address can be zero as
+	 * well (IGMPv3/MLDv2 allow an unspecified report source address), but
+	 * its real source entries are still counted.
+	 */
+	if (memcmp(&set_h->eht_set->src_addr, &zero_addr, sizeof(zero_addr)))
 		eht_host->num_entries--;
 	hlist_add_head(&set_h->mcast_gc.gc_node, &set_h->br->mcast_gc_list);
 	queue_work(system_long_wq, &set_h->br->mcast_gc_work);
-- 
2.34.1

Re: [PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[Cheng Yongkang]

The PoC sends an IGMPv3/MLDv2 report from the unspecified source
address, creates and deletes the corresponding EHT set entries, and
observes that the host's num_entries budget is not released, while the
same sequence with a non-zero report source releases it.