Re: [PATCH net v3] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

[Simon Horman]

On Thu, Apr 02, 2026 at 09:48:57AM +0000, Oleh Konko wrote:
> The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
> bc_ackers on every inbound group ACK, even when the same member has
> already acknowledged the current broadcast round.
> 
> Because bc_ackers is a u16, a duplicate ACK received after the last
> legitimate ACK wraps the counter to 65535. Once wrapped,
> tipc_group_bc_cong() keeps reporting congestion and later group
> broadcasts on the affected socket stay blocked until the group is
> recreated.
> 
> Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
> bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
> prevents the underflow path.
> 
> Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Oleh Konko <security@xxxxxxxxx>
> ---
> v3:
> - correct the Fixes tag to the commit that introduced GRP_ACK_MSG and bc_ackers
> 
> v2:
> - make duplicate or stale GRP_ACK_MSG a full no-op via early return
> - place acked in reverse xmas tree style

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>