diff options
| author | Wenbo Sun <sunwenbo@cmss.chinamobile.com> | 2026-11-11 11:11:47 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-11-12 10:44:46 -0800 |
| commit | 6730fe495c35f174a424ab58cf5fdf99ce4746e9 (patch) | |
| tree | dbdc4edda18cda453532b8e9022c184c4ecb1be1 /drivers | |
| parent | 0359338fd8cf1a2dc001d0cd69c331c17decee88 (diff) | |
| download | linux-6730fe495c35f174a424ab58cf5fdf99ce4746e9.tar.gz linux-6730fe495c35f174a424ab58cf5fdf99ce4746e9.zip | |
amt: use ipv6_hdr() in amt_mldv1_leave_handler()
In amt_mldv1_leave_handler(), which handles IPv6 MLDv1 Done
(ICMPV6_MGM_REDUCTION) messages, the source address is mistakenly
extracted via ip_hdr(skb)->saddr into host.ip4 instead of copying the
IPv6 source address from ipv6_hdr(skb)->saddr into host.ip6 as
amt_mldv1_report_handler() does.
Because amt_lookup_group() compares the full union amt_addr for v6
groups, looking up the group with a 32-bit IPv4 header slice fails to
match the group entry created by amt_mldv1_report_handler(). As a
result, amt_del_group() is not called when an MLDv1 listener leaves,
and the AMT relay continues forwarding multicast traffic until the
group timer expires.
Use ipv6_hdr(skb) and copy ip6h->saddr into host.ip6 so that MLDv1
Done messages properly match and delete the corresponding IPv6 group.
This issue was found via LLM-assisted code review, confirmed by
reproducing the stale group forwarding in a User-Mode Linux (ARCH=um)
environment, and verified in UML by testing that AMT relay multicast
forwarding stops immediately after receiving an MLDv1 Done message.
Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261111031147.105834-1-sunwenbo@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/amt.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/net/amt.c b/drivers/net/amt.c index e7fa09e36803..8b9fc3d11ece 100644 --- a/drivers/net/amt.c +++ b/drivers/net/amt.c @@ -2147,13 +2147,12 @@ static void amt_mldv1_leave_handler(struct amt_dev *amt, struct sk_buff *skb, struct amt_tunnel_list *tunnel) { struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); - struct iphdr *iph = ip_hdr(skb); + struct ipv6hdr *ip6h = ipv6_hdr(skb); struct amt_group_node *gnode; union amt_addr group, host; memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr)); - memset(&host, 0, sizeof(union amt_addr)); - host.ip4 = iph->saddr; + memcpy(&host.ip6, &ip6h->saddr, sizeof(struct in6_addr)); gnode = amt_lookup_group(tunnel, &group, &host, true); if (gnode) { |