Re: [PATCH net 3/5] ipv6: restrict mld_qrv to 255
From: Fernando Fernandez Mancera
Date: Fri Oct 23 2026 - 10:20:36 EST
On 10/23/26 11:13 AM, Jiayuan Chen wrote:
net.ipv6.mld_qrv only has a lower bound, but ipv6_mc_reset() stores itReviewed-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>
into the u8 inet6_dev::mc_qrv, and every MLD retransmit counter derived
from it (mca_crcount, sf_crcount, mc_ifc_count, mc_dad_count) is u8 as
well. Anything above 255 silently wraps: 256 becomes 0, so no state
change report is ever retransmitted, and the first MLDv2 Query received
on the interface then trips the WARN_ON() in mld_update_qrv():
WARN_ON(idev->mc_qrv == 0);
A plain bridge with mcast_querier enabled on the link is enough:
WARNING: net/ipv6/mcast.c:1327 at mld_query_work+0x1fd2/0x2cb0, CPU#3: kworker/3:1/2688
Workqueue: mld mld_query_work
RIP: 0010:mld_query_work+0x1fd2/0x2cb0
Call Trace:
<TASK>
process_one_work+0x93a/0x1b20
worker_thread+0x6d0/0x11d0
kthread+0x358/0x470
ret_from_fork+0x5b3/0x820
ret_from_fork_asm+0x1a/0x30
</TASK>
Cap the sysctl at U8_MAX, the largest value mc_qrv can actually hold.
Fixes: 2f711939d2ea ("ipv6: add sysctl_mld_qrv to configure query robustness variable")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
Thanks!