Re: [PATCH net v3 3/5] ipv6: restrict mld_qrv to 255

[Hangbin Liu]

On Sun, Nov 01, 2026 at 02:12:01PM +0800, Jiayuan Chen wrote:
> net.ipv6.mld_qrv only has a lower bound, but ipv6_mc_reset() stores it
> into the u8 inet6_dev::mc_qrv, so 256 wraps to 0 and the first MLDv2
> Query received on the interface trips the WARN_ON() in mld_update_qrv():
> 
> 	WARN_ON(idev->mc_qrv == 0);
> 
>   WARNING: net/ipv6/mcast.c:1327 at mld_query_work+0x1fd2/0x2cb0, CPU#3: kworker/3:1/2688
>   Workqueue: mld mld_query_work
>   RIP: 0010:mld_query_work+0x1fd2/0x2cb0
>   Call Trace:
>    <TASK>
>    process_one_work+0x93a/0x1b20
>    worker_thread+0x6d0/0x11d0
>    kthread+0x358/0x470
>    ret_from_fork+0x5b3/0x820
>    ret_from_fork_asm+0x1a/0x30
>    </TASK>
> 
> Make the sysctl a u8 like mc_qrv and switch to proc_dou8vec_minmax(),
> which rejects anything above 255, and document it.
> 
> Fixes: 2f711939d2ea ("ipv6: add sysctl_mld_qrv to configure query robustness variable")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> ---
> v2: switched to u8 and proc_dou8vec_minmax(), as suggested by Kuniyuki
> Iwashima.
> ---
>  Documentation/networking/ip-sysctl.rst | 2 ++
>  include/net/ipv6.h                     | 2 +-
>  net/ipv6/mcast.c                       | 2 +-
>  net/ipv6/sysctl_net_ipv6.c             | 4 ++--
>  4 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
> index 4b19c8d3efda7..71f334f27004e 100644
> --- a/Documentation/networking/ip-sysctl.rst
> +++ b/Documentation/networking/ip-sysctl.rst
> @@ -2515,6 +2515,8 @@ mld_qrv - INTEGER
>  
>  	Minimum: 1 (as specified by RFC6636 4.5)
>  
> +	Maximum: 255
> +
>  max_dst_opts_number - INTEGER
>  	Maximum number of non-padding TLVs allowed in a Destination
>  	options extension header. If this value is less than zero
> diff --git a/include/net/ipv6.h b/include/net/ipv6.h
> index 3de07e738538f..4901a92066e61 100644
> --- a/include/net/ipv6.h
> +++ b/include/net/ipv6.h
> @@ -205,7 +205,7 @@ struct sk_buff *ip6_frag_next(struct sk_buff *skb,
>  
>  /* sysctls */
>  extern int sysctl_mld_max_msf;
> -extern int sysctl_mld_qrv;
> +extern u8 sysctl_mld_qrv;
>  
>  #define _DEVINC(net, statname, mod, idev, field)			\
>  ({									\
> diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
> index ecef55f261890..13f31132e0f97 100644
> --- a/net/ipv6/mcast.c
> +++ b/net/ipv6/mcast.c
> @@ -106,7 +106,7 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
>  #define IPV6_MLD_MAX_MSF	64
>  
>  int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
> -int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
> +u8 sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
>  
>  #define mc_assert_locked(idev)			\
>  	lockdep_assert_held(&(idev)->mc_lock)
> diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
> index 1a0a36dcdabc1..f3ac04dbc71d0 100644
> --- a/net/ipv6/sysctl_net_ipv6.c
> +++ b/net/ipv6/sysctl_net_ipv6.c
> @@ -226,9 +226,9 @@ static struct ctl_table ipv6_rotable[] = {
>  	{
>  		.procname	= "mld_qrv",
>  		.data		= &sysctl_mld_qrv,
> -		.maxlen		= sizeof(int),
> +		.maxlen		= sizeof(u8),
>  		.mode		= 0644,
> -		.proc_handler	= proc_dointvec_minmax,
> +		.proc_handler	= proc_dou8vec_minmax,
>  		.extra1		= SYSCTL_ONE
>  	},
>  #ifdef CONFIG_NETLABEL
> -- 
> 2.43.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>