[PATCH net] amt: use ipv6_hdr() in amt_mldv1_leave_handler()

[PATCH net] amt: use ipv6_hdr() in amt_mldv1_leave_handler()

[Wenbo Sun]

In amt_mldv1_leave_handler(), which handles IPv6 MLDv1 Done
(ICMPV6_MGM_REDUCTION) messages, the source address is mistakenly
extracted via ip_hdr(skb)->saddr into host.ip4 instead of copying the
IPv6 source address from ipv6_hdr(skb)->saddr into host.ip6 as
amt_mldv1_report_handler() does.

Because amt_lookup_group() compares the full union amt_addr for v6
groups, looking up the group with a 32-bit IPv4 header slice fails to
match the group entry created by amt_mldv1_report_handler(). As a
result, amt_del_group() is not called when an MLDv1 listener leaves,
and the AMT relay continues forwarding multicast traffic until the
group timer expires.

Use ipv6_hdr(skb) and copy ip6h->saddr into host.ip6 so that MLDv1
Done messages properly match and delete the corresponding IPv6 group.

This issue was found via LLM-assisted code review, confirmed by
reproducing the stale group forwarding in a User-Mode Linux (ARCH=um)
environment, and verified in UML by testing that AMT relay multicast
forwarding stops immediately after receiving an MLDv1 Done message.

Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 drivers/net/amt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 81d26ef82cf5..31d91ab7c9ac 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -2147,13 +2147,12 @@ static void amt_mldv1_leave_handler(struct amt_dev *amt, struct sk_buff *skb,
 				    struct amt_tunnel_list *tunnel)
 {
 	struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb);
-	struct iphdr *iph = ip_hdr(skb);
+	struct ipv6hdr *ip6h = ipv6_hdr(skb);
 	struct amt_group_node *gnode;
 	union amt_addr group, host;
 
 	memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr));
-	memset(&host, 0, sizeof(union amt_addr));
-	host.ip4 = iph->saddr;
+	memcpy(&host.ip6, &ip6h->saddr, sizeof(struct in6_addr));
 
 	gnode = amt_lookup_group(tunnel, &group, &host, true);
 	if (gnode) {
-- 
2.33.0

Re: [PATCH net] amt: use ipv6_hdr() in amt_mldv1_leave_handler()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 11 Nov 2026 11:11:47 +0800 you wrote:
> In amt_mldv1_leave_handler(), which handles IPv6 MLDv1 Done
> (ICMPV6_MGM_REDUCTION) messages, the source address is mistakenly
> extracted via ip_hdr(skb)->saddr into host.ip4 instead of copying the
> IPv6 source address from ipv6_hdr(skb)->saddr into host.ip6 as
> amt_mldv1_report_handler() does.
> 
> Because amt_lookup_group() compares the full union amt_addr for v6
> groups, looking up the group with a 32-bit IPv4 header slice fails to
> match the group entry created by amt_mldv1_report_handler(). As a
> result, amt_del_group() is not called when an MLDv1 listener leaves,
> and the AMT relay continues forwarding multicast traffic until the
> group timer expires.
> 
> [...]

Here is the summary with links:
  - [net] amt: use ipv6_hdr() in amt_mldv1_leave_handler()
    https://git.kernel.org/netdev/net/c/6730fe495c35

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html