On 29/10/2026 16:12, Cheng Yongkang wrote:
__eht_del_set_entry() decrements eht_host->num_entries only when the set entry's host address is non-zero. A report sent from the unspecified source address 0.0.0.0 (or in6addr_any for MLDv2) creates an EHT host with h_addr == 0, while the set entries created for its sources have non-zero source addresses and are counted against PG_SRC_ENT_LIMIT. Deleting those sources never releases the host's budget; after 32 counted sources the host stays at num_entries == 32 and every later counted set entry is refused. The same sequence with a non-zero report source releases the budget normally:host 0.0.0.0: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/32 host 10.9.9.9: IS_EXC/ALLOW1/BLOCK/ALLOW2 = 32/0/32/0 Only set entries created for a non-zero source address are counted: br_multicast_create_eht_set_entry() rejects a zero source when allow_zero_src is false, and __eht_lookup_create_set_entry() increments num_entries only for those entries. The auto-created wildcard entry for a zero host uses allow_zero_src == true and is not counted. Release the budget based on eht_set->src_addr instead of h_addr, so counted entries decrement for zero-address hosts as well. The uncounted wildcard entry no longer decrements the counter, which also removes the converse mismatch for non-zero hosts. Fixes: baa74d39ca39 ("net: bridge: multicast: add EHT source set handling functions") Cc: [email protected] Assisted-by: LLM Signed-off-by: Cheng Yongkang <[email protected]> --- net/bridge/br_multicast_eht.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_multicast_eht.c b/net/bridge/br_multicast_eht.c index 18eaf9c..548ad78 100644 --- a/net/bridge/br_multicast_eht.c +++ b/net/bridge/br_multicast_eht.c @@ -167,7 +167,14 @@ static void __eht_del_set_entry(struct net_bridge_group_eht_set_entry *set_h) RB_CLEAR_NODE(&set_h->rb_node); hlist_del_init(&set_h->host_list); memset(&zero_addr, 0, sizeof(zero_addr)); - if (memcmp(&set_h->h_addr, &zero_addr, sizeof(zero_addr))) + /* Only set entries created for a non-zero source address are counted + * towards the host's budget, the auto-created zero source entry is + * not (see __eht_lookup_create_set_entry()). Check the set's source + * address and not the host address: the host address can be zero as + * well (IGMPv3/MLDv2 allow an unspecified report source address), but + * its real source entries are still counted. + */ + if (memcmp(&set_h->eht_set->src_addr, &zero_addr, sizeof(zero_addr))) eht_host->num_entries--; hlist_add_head(&set_h->mcast_gc.gc_node, &set_h->br->mcast_gc_list); queue_work(system_long_wq, &set_h->br->mcast_gc_work);
I don't think this is a -net fix, it can target net-next when it opens up. You can also trim the comment, it is way too verbose for something so simple. Thanks, Nik
