[PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[Oleh Konko]

The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
bc_ackers on every inbound group ACK, even when the same member has
already acknowledged the current broadcast round.

Because bc_ackers is a u16, a duplicate ACK received after the last
legitimate ACK wraps the counter to 65535. Once wrapped,
tipc_group_bc_cong() keeps reporting congestion and later group
broadcasts on the affected socket stay blocked until the group is
recreated.

Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
prevents the underflow path.

Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
---
v3:
- correct the Fixes tag to the commit that introduced GRP_ACK_MSG and bc_ackers

v2:
- make duplicate or stale GRP_ACK_MSG a full no-op via early return
- place acked in reverse xmas tree style

 net/tipc/group.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/tipc/group.c b/net/tipc/group.c
index e0e6227b433..14e6732624e 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -746,6 +746,7 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
 	u32 port = msg_origport(hdr);
 	struct tipc_member *m, *pm;
 	u16 remitted, in_flight;
+	u16 acked;
 
 	if (!grp)
 		return;
@@ -798,7 +799,10 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
 	case GRP_ACK_MSG:
 		if (!m)
 			return;
-		m->bc_acked = msg_grp_bc_acked(hdr);
+		acked = msg_grp_bc_acked(hdr);
+		if (less_eq(acked, m->bc_acked))
+			return;
+		m->bc_acked = acked;
 		if (--grp->bc_ackers)
 			return;
 		list_del_init(&m->small_win);
-- 
2.50.0

RE: [PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[Tung Quang Nguyen]

>Subject: [PATCH net v3] tipc: fix bc_ackers underflow on duplicate
>GRP_ACK_MSG
>
>The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
>bc_ackers on every inbound group ACK, even when the same member has
>already acknowledged the current broadcast round.
>
>Because bc_ackers is a u16, a duplicate ACK received after the last legitimate
>ACK wraps the counter to 65535. Once wrapped,
>tipc_group_bc_cong() keeps reporting congestion and later group broadcasts
>on the affected socket stay blocked until the group is recreated.
>
>Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
>bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
>prevents the underflow path.
>
>Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass
>group unicast")
>Cc: stable@vger.kernel.org
>Signed-off-by: Oleh Konko <security@1seal.org>
>---
>v3:
>- correct the Fixes tag to the commit that introduced GRP_ACK_MSG and
>bc_ackers
>
>v2:
>- make duplicate or stale GRP_ACK_MSG a full no-op via early return
>- place acked in reverse xmas tree style
>
> net/tipc/group.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/net/tipc/group.c b/net/tipc/group.c index
>e0e6227b433..14e6732624e 100644
>--- a/net/tipc/group.c
>+++ b/net/tipc/group.c
>@@ -746,6 +746,7 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool
>*usr_wakeup,
> 	u32 port = msg_origport(hdr);
> 	struct tipc_member *m, *pm;
> 	u16 remitted, in_flight;
>+	u16 acked;
>
> 	if (!grp)
> 		return;
>@@ -798,7 +799,10 @@ void tipc_group_proto_rcv(struct tipc_group *grp,
>bool *usr_wakeup,
> 	case GRP_ACK_MSG:
> 		if (!m)
> 			return;
>-		m->bc_acked = msg_grp_bc_acked(hdr);
>+		acked = msg_grp_bc_acked(hdr);
>+		if (less_eq(acked, m->bc_acked))
>+			return;
>+		m->bc_acked = acked;
> 		if (--grp->bc_ackers)
> 			return;
> 		list_del_init(&m->small_win);
>--
>2.50.0
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>

Re: [PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[Simon Horman]

On Thu, Apr 02, 2026 at 09:48:57AM +0000, Oleh Konko wrote:
> The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
> bc_ackers on every inbound group ACK, even when the same member has
> already acknowledged the current broadcast round.
> 
> Because bc_ackers is a u16, a duplicate ACK received after the last
> legitimate ACK wraps the counter to 65535. Once wrapped,
> tipc_group_bc_cong() keeps reporting congestion and later group
> broadcasts on the affected socket stay blocked until the group is
> recreated.
> 
> Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
> bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
> prevents the underflow path.
> 
> Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
> Cc: stable@vger.kernel.org
> Signed-off-by: Oleh Konko <security@1seal.org>
> ---
> v3:
> - correct the Fixes tag to the commit that introduced GRP_ACK_MSG and bc_ackers
> 
> v2:
> - make duplicate or stale GRP_ACK_MSG a full no-op via early return
> - place acked in reverse xmas tree style

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 2 Apr 2026 09:48:57 +0000 you wrote:
> The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
> bc_ackers on every inbound group ACK, even when the same member has
> already acknowledged the current broadcast round.
> 
> Because bc_ackers is a u16, a duplicate ACK received after the last
> legitimate ACK wraps the counter to 65535. Once wrapped,
> tipc_group_bc_cong() keeps reporting congestion and later group
> broadcasts on the affected socket stay blocked until the group is
> recreated.
> 
> [...]

Here is the summary with links:
  - [net,v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    https://git.kernel.org/netdev/net/c/48a5fe38772b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html