__eht_del_set_entry() decrements eht_host->num_entries only when the set
entry's host address is non-zero. A report sent from the unspecified
source address 0.0.0.0 (or in6addr_any for MLDv2) creates an EHT host
with h_addr == 0, while the set entries created for its sources have
non-zero source addresses and are counted against PG_SRC_ENT_LIMIT.
Deleting those sources never releases the host's budget; after 32 counted
sources the host stays at num_entries == 32 and every later counted set
entry is refused. The same sequence with a non-zero report source
releases the budget normally:
host 0.0.0.0: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/32
host 10.9.9.9: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/0
Only set entries created for a non-zero source address are counted:
br_multicast_create_eht_set_entry() rejects a zero source when
allow_zero_src is false, and __eht_lookup_create_set_entry() increments
num_entries only for those entries. The auto-created wildcard entry for
a zero host uses allow_zero_src == true and is not counted. Release the
budget based on eht_set->src_addr instead of h_addr, so counted entries
decrement for zero-address hosts as well. The uncounted wildcard entry
no longer decrements the counter, which also removes the converse
mismatch for non-zero hosts.
Fixes: baa74d39ca39 ("net: bridge: multicast: add EHT source set handling
functions")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <[email protected]>
---
net/bridge/br_multicast_eht.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c
index 18eaf9c..548ad78 100644
--- a/net/bridge/br_multicast_eht.c
+++ b/net/bridge/br_multicast_eht.c
@@ -167,7 +167,14 @@ static void __eht_del_set_entry(struct
net_bridge_group_eht_set_entry *set_h)
RB_CLEAR_NODE(&set_h->rb_node);
hlist_del_init(&set_h->host_list);
memset(&zero_addr, 0, sizeof(zero_addr));
- if (memcmp(&set_h->h_addr, &zero_addr, sizeof(zero_addr)))
+ /* Only set entries created for a non-zero source address are counted
+ * towards the host's budget, the auto-created zero source entry is
+ * not (see __eht_lookup_create_set_entry()). Check the set's source
+ * address and not the host address: the host address can be zero as
+ * well (IGMPv3/MLDv2 allow an unspecified report source address), but
+ * its real source entries are still counted.
+ */
+ if (memcmp(&set_h->eht_set->src_addr, &zero_addr, sizeof(zero_addr)))
eht_host->num_entries--;
hlist_add_head(&set_h->mcast_gc.gc_node, &set_h->br->mcast_gc_list);
queue_work(system_long_wq, &set_h->br->mcast_gc_work);
--
2.34.1
