Re: [PATCH net] net: bridge: mcast: release the EHT host budget for zero-address hosts

[Nikolay Aleksandrov <razor@blackwall.org>]

On 29/10/2026 16:12, Cheng Yongkang wrote:
> __eht_del_set_entry() decrements eht_host->num_entries only when the set
> entry's host address is non-zero.  A report sent from the unspecified
> source address 0.0.0.0 (or in6addr_any for MLDv2) creates an EHT host
> with h_addr == 0, while the set entries created for its sources have
> non-zero source addresses and are counted against PG_SRC_ENT_LIMIT.
> Deleting those sources never releases the host's budget; after 32 counted
> sources the host stays at num_entries == 32 and every later counted set
> entry is refused.  The same sequence with a non-zero report source
> releases the budget normally:
> 
>    host 0.0.0.0:  IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/32
>    host 10.9.9.9: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/0
> 
> Only set entries created for a non-zero source address are counted:
> br_multicast_create_eht_set_entry() rejects a zero source when
> allow_zero_src is false, and __eht_lookup_create_set_entry() increments
> num_entries only for those entries.  The auto-created wildcard entry for
> a zero host uses allow_zero_src == true and is not counted.  Release the
> budget based on eht_set->src_addr instead of h_addr, so counted entries
> decrement for zero-address hosts as well.  The uncounted wildcard entry
> no longer decrements the counter, which also removes the converse
> mismatch for non-zero hosts.
> 
> Fixes: baa74d39ca39 ("net: bridge: multicast: add EHT source set handling functions")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
> ---
>   net/bridge/br_multicast_eht.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c
> index 18eaf9c..548ad78 100644
> --- a/net/bridge/br_multicast_eht.c
> +++ b/net/bridge/br_multicast_eht.c
> @@ -167,7 +167,14 @@ static void __eht_del_set_entry(struct net_bridge_group_eht_set_entry *set_h)
>   	RB_CLEAR_NODE(&set_h->rb_node);
>   	hlist_del_init(&set_h->host_list);
>   	memset(&zero_addr, 0, sizeof(zero_addr));
> -	if (memcmp(&set_h->h_addr, &zero_addr, sizeof(zero_addr)))
> +	/* Only set entries created for a non-zero source address are counted
> +	 * towards the host's budget, the auto-created zero source entry is
> +	 * not (see __eht_lookup_create_set_entry()).  Check the set's source
> +	 * address and not the host address: the host address can be zero as
> +	 * well (IGMPv3/MLDv2 allow an unspecified report source address), but
> +	 * its real source entries are still counted.
> +	 */
> +	if (memcmp(&set_h->eht_set->src_addr, &zero_addr, sizeof(zero_addr)))
>   		eht_host->num_entries--;
>   	hlist_add_head(&set_h->mcast_gc.gc_node, &set_h->br->mcast_gc_list);
>   	queue_work(system_long_wq, &set_h->br->mcast_gc_work);

I don't think this is a -net fix, it can target net-next when it opens up.
You can also trim the comment, it is way too verbose for something so simple.

Thanks,
  Nik