Re: [PATCH v2 net 3/5] ipv6: mcast: fix delay calculation in igmp6_join_group()

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Aug 28, 2026 at 08:45:29AM +0000, Eric Dumazet wrote:
> When joining a multicast group, if a report work is already pending
> (e.g. scheduled by a query or a previous join), igmp6_join_group()
> cancels the delayed work and recalculates the delay:
> 
> 	if (cancel_delayed_work(&ma->mca_work)) {
> 		refcount_dec(&ma->mca_refcnt);
> 		delay = ma->mca_work.timer.expires - jiffies;
> 	}
> 
> Unlike igmp6_group_queried(), igmp6_join_group() did not check
> if delay >= interval. This leads to two issues:
> 
> 1. If the timer has already expired (timer.expires <= jiffies), the
>    stale expiry is reused by mod_delayed_work(), causing the second
>    unsolicited report to fire on the very next tick without a
>    randomized delay.
> 2. If the timer was originally armed by a query with a large
>    maximum response delay, delay could exceed
>    unsolicited_report_interval(ma->idev).
> 
> Fix this by initializing delay to unsolicited_report_interval(ma->idev)
> and re-randomizing it with get_random_u32_below(interval) when
> delay >= interval, mirroring the logic in igmp6_group_queried().
> 
> Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work")

Looks like it was broken from the start:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Taehee Yoo <ap420073@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>