Re: [PATCH net] net: bridge: mcast: validate the source limit before replace

[Ido Schimmel]

On Thu, Oct 29, 2026 at 07:12:20AM -0700, Cheng Yongkang wrote:
> br_mdb_replace_group_srcs() marks every existing source for deletion and
> then re-adds the sources named by the NLM_F_REPLACE request.  The add loop
> checks PG_SRC_ENT_LIMIT before allocating each new source; if the
> transient source count reaches the limit, br_mdb_add_group_srcs() unwinds
> by deleting every source it processed, including the pre-existing sources
> it just refreshed.  The error path only clears BR_SGRP_F_DELETE and
> cannot restore those sources or their (S,G) entries.
> 
> A replace with E existing sources and N distinct request sources not
> already in the group fails at the limit if and only if E + N exceeds
> PG_SRC_ENT_LIMIT.  The rejected request currently leaves the group with
> one fewer source and removes that source's (S,G) entry:
> 
>   before: (*,G) star_srcs=31, S present, (S,G) present
>   after rejected replace: star_srcs=30, S and (S,G) removed
> 
> Count those new sources and reject the request with -ENOSPC before any
> source is marked deleted or added, so a rejected replace changes no
> state.  Valid replaces, including ones that transiently reach the limit,
> keep the same behavior.  Other add-loop failure paths are unchanged.
> 
> Fixes: 61f2183512a7 ("bridge: mcast: Support replacement of MDB port group entries")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@xxxxxxxxx>
> ---
>  net/bridge/br_mdb.c | 51 ++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 50 insertions(+), 1 deletion(-)

I'm not going to review this. You already sent a bridge patch [1], which
I reviewed, asked for changes and you didn't follow up. I can only
assume that the same will happen here. I'm reacting this way because
this pattern is not unique to you (see my reply in [1], for example) and
I'm tired of it. Get a patch merged, then continue to the next one.

Also, AFAICT, this patch doesn't fix a regression (never worked) or a
security issue, so should be targeted at net-next which is currently
closed [2].

[1] https://lore.kernel.org/netdev/179268538303.70821.8213834342995341232@xxxxxxxxx/
[2] https://netdev.bots.linux.dev/net-next.html