zhhyu7 opened a new pull request, #21246: URL: https://github.com/apache/nuttx/pull/21246
## Summary The multicast use case group already has a member when it is being allocated. Therefore, the parameter group->join should be directly initialized to 1. `mld_grpalloc()` leaves `group->njoins` at 0, and callers are inconsistent about fixing it up: `mld_joingroup()` set it to 1 after allocating, but `mld_devinit()` and `mld_grpallocfind()` did not. Any group created outside the join path therefore starts with a join count of 0 while already having a member, so the next `IPV6_LEAVE_GROUP` decrements from 0 and underflows the `uint8_t` counter to 255. A multicast group has one member the moment it is allocated, so `njoins` is now initialized to 1 in `mld_grpalloc()` and the redundant assignment in `mld_joingroup()` is removed. ## Impact Affects any `CONFIG_NET_MLD` config. Visible as a failed `DEBUGASSERT(group->njoins > 0)` in `mld_join.c` on non-router builds, or a group that can never be torn down on router builds. ## Testing `sim:dynconns` (`CONFIG_NET_MLD=y`, `CONFIG_DEBUG_ASSERTIONS=y`), test app joins then leaves three groups: the `ff02::1` group pre-allocated by `mld_devinit()`, a group created by the join itself, and a re-join of an existing group. | Config | Before | After | |---|---|---| | `NET_MLD_ROUTER=n` | assertion failed at `mld_join.c:230` | PASS, all 6 calls ret=0 | | `NET_MLD_ROUTER=y` | PASS (no assert on this path) | PASS, Done message sent on leave | `nxstyle` passes on both changed files. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
