From nobody Wed Apr 1 09:44:31 2026 Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022140.outbound.protection.outlook.com [52.101.66.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C073334C05; Mon, 30 Mar 2026 15:05:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.66.140 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774883117; cv=fail; b=UykjlvD+UpfM4b4T8FJxMKdHKM/0ctc+3QZ9RaylrY126IbWJ+Arz0Eh680W4Kp2/IjXMSv2D7igF1z0VEl21YA4pcOdDH1hkRE3qHve/MzQTMBA8cgLE+OPBW2WtnPivu+6ehwQpxieKRjT0kWsYLZsiXCmcJ6jSZo0jXJTyaM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774883117; c=relaxed/simple; bh=lF9SVCHj/EMo9LnMnAZkcOK9dwZBfnHtGDvFkmwWJVE=; h=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version; b=dwHMbq1wkjDedbAM2EDdtRMlhgbkNikRygN0e28hbSgZlN7IprBglfSHVIO7PsS5Ph0L3xW35RAnJaoqpQnnfyA8vVXdljoSXtmsECvs/qb3gJhc+nFUa/hhXVCr1z2fU/AG6yiH8c5qWjubS95Fo1Z5iScSqOici3j9jY6WIdg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=1seal.org; spf=pass smtp.mailfrom=1seal.org; dkim=pass (2048-bit key) header.d=1seal.org header.i=@1seal.org header.b=QGXgUM4M; arc=fail smtp.client-ip=52.101.66.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=1seal.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=1seal.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=1seal.org header.i=@1seal.org header.b="QGXgUM4M" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JCRvaT9AHj0iiXAbH9eaLaAusJrqdq03K8P2HvixlfM9Qfzu7ZR/0hRVtgCx2TWyyo+VVeo3MSHrhKbMIaBQIE8UJiiUo7c9xquwu6ZOES3xxMhPcaKJh6qAVNdsfUvdKWWlGHwViekNbyjfTdTd3bv99U6VikOBq919jX56NWpNg/0ZwSrkRJyBgqLsjCRz4MwhHw+jbkql0ffBvZ4BBP9GWgyCnPxUtXAsfIA30zIRnXST+cMekA3QfLgfG5dOMu+uLCpL8bY5T43FSw7/XgdnX2F1+cgvE/k722GJRXctRY8Kl3lnq5SpU2yw/lwW/NEPBh03oT/czmADib1gAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lF9SVCHj/EMo9LnMnAZkcOK9dwZBfnHtGDvFkmwWJVE=; b=GXmDqt5XB3aTFdD7/7mfBPYHM+lcAA02LoqyyjGlHUymcdTPhoaknbmxAh864PG4xBtm9d1MLoVrTuBFHTtmUs21zP49NRsxxFVvTAE1eIXeyYxyHVdN7ii9FVjzUtL+XHBgGIQi0AHPDS+/yp1qpCChQZqWgTec39s7fZOLAxPYpJN0oMIuCECq9udNlrC5DXRrEcBqA4ePeE8gX2ejw4rquBFQfpkc6IDF4mRICqydXfY9COSpRu3vXYEyLaYK0Rjv/rDF2SDViPjlGUZQ4al/liL46mCY0bRUTMPq40/RtlGTVKLiozkSBNhOixFf0aAHJYiU0R+Js7/lR0LOvw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=1seal.org; dmarc=pass action=none header.from=1seal.org; dkim=pass header.d=1seal.org; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1seal.org; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lF9SVCHj/EMo9LnMnAZkcOK9dwZBfnHtGDvFkmwWJVE=; b=QGXgUM4MkepAU1TnkMEEtDfgUPPcsYP8uUAQtlT/wCnZzvHJLZJVcVRvDnFd/tfLXpG6RcNy9mFKsj4HbQ4RAVw8kj9yuVGxuLFLMeUHK5VpPZsEurgr1CovBWbznEf3N7THn/ONC1bvpED4OfgsMy0SrNsk80f1MEZYqOuFPP25X5P1JPKENSwirlpeAWXfI/bkMndO86HVqgZ400W7Y8Fapj6zyjOQy7TFbaN2Nzo1VZErnZ0+gIRLr6CDizXmFxKZpUHzDTe45Y7EMTzwV6WAkOW3LMqU3IP32ufe0JfoTfGf2mGCE5mc3fy5vYgeTbUJGW6EnRFi9bzpBA54mQ== Received: from DBBPR04MB7673.eurprd04.prod.outlook.com (2603:10a6:10:202::5) by FRWPR04MB11103.eurprd04.prod.outlook.com (2603:10a6:d10:172::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.27; Mon, 30 Mar 2026 15:05:08 +0000 Received: from DBBPR04MB7673.eurprd04.prod.outlook.com ([fe80::cf39:9ba0:2b9c:419]) by DBBPR04MB7673.eurprd04.prod.outlook.com ([fe80::cf39:9ba0:2b9c:419%3]) with mapi id 15.20.9745.027; Mon, 30 Mar 2026 15:05:08 +0000 From: Oleh Konko To: "netdev@vger.kernel.org" CC: "jmaloy@redhat.com" , "davem@davemloft.net" , "edumazet@google.com" , "kuba@kernel.org" , "pabeni@redhat.com" , "horms@kernel.org" , "tipc-discussion@lists.sourceforge.net" , "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH net] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Thread-Topic: [PATCH net] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG Thread-Index: AQHcwFaZgpnD0jkjNUO+2TpEMAczLg== Date: Mon, 30 Mar 2026 15:05:08 +0000 Message-ID: <043673b8636b4f60a52589330cb55e83.security@1seal.org> Accept-Language: ru-RU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=1seal.org; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: DBBPR04MB7673:EE_|FRWPR04MB11103:EE_ x-ms-office365-filtering-correlation-id: f33fce6f-b59d-4ea0-4e8c-08de8e6dbbd3 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|7416014|376014|366016|1800799024|38070700021|18002099003|56012099003|7055299006; x-microsoft-antispam-message-info: +Iy/HMm0YvLO2Pc4gSStmpKG5a6YoezapfZt2u+V2N2MEA8nZ/a2bD1oNJdziQGRBUgjuJ+dVpDhOa5DLZ5POU8tlF3D+BjEl6wodBRW0gwgveRnV9w5MAr+KJ7jJUcIoXUMBw4fuw73HHTmzcx0h7cLz3T2T5ia+5bPyY+6w4oZxoIYhdgQpQCdD3M6O0UCAPbd80BGwa6mkXtfaqflV/83f/3ucvR31P+yI5QWpgiRsf+ABHZJ812UiMrF9mnsIadmnJWOyJ6LhktCqv3h6pfYh6oXy11WGFAD0YHjom1nD9s6X004CERkuQpFLyFpU1McvNUVmGllqd+WDSKe7/NKwQIH+W2IF8NbigC3ziSTphB7mjooYmcOS7qusGZXPUu9uVk92ONli7rLn983/QKg3AE6nyaOObcUd9fzfaoZfTcAoEdB6aNEnw/MiYEeFliAowsYpfg8SKFwU6vMRMkagxGFzgu+CR/M2Bu8vS8ALpPYUnr71fP8ipvVKCn2s0SniClXa9Nupw15G8RMPWqX573HoXlH+1QT3EC/9oGHGUKs8KLzUo3VJwnJVKliIFGRHqFpEdt0AzaS/ZCPs+xbc19wmWQkecnkESffoJ2R1B0aHAVI+3abR9fN06iDMZNuonTLHTfv0mV43M7UGgvxusdoNHAE+Q+IowrlF3CmRV4r5+S5gh+ExptNnAD38gdRIWfpGObv6O44bVrAqHU3ciJ7WfORVZ6ynOyzDe1HGz6tw+kNRxIPQxkKuJp/1qMPXiEsqqjx2rn34w3WnlcfYIxSPl7towoAV14Md+MDZAi3S4tg9Hx8/jNPioLz x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DBBPR04MB7673.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(7416014)(376014)(366016)(1800799024)(38070700021)(18002099003)(56012099003)(7055299006);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?M0NSWTd5ZE4zc2hhTzNHaVplVG04L3REVERkQnE4VGFnMFRCMGQxTmozWHJi?= =?utf-8?B?ZHpYUzI2R1dRaUx1azVtWHJuTkVWTEpKTm1EYmVDR3NJaXViQ1Y1NXZOcnlp?= =?utf-8?B?dnhUbTRvQ1VBd0tHR3pkaUNHZ1ZVYitEQjNhVEg2SnA3bjMreHZWYUdxdmNa?= =?utf-8?B?aC9rZU0wUXZ2YTdlYjUzaFhkLzNuZHZSd0JjRVB0cVFPd2FUaUdHalhtdGVV?= =?utf-8?B?dXEzVFRvV0FGYVc1Mkx0ZlgxUjN4a3RtMkJwMTI0VGVEVGk5U0J1T0x0bG5m?= =?utf-8?B?UVNxUXRUTHRlU2U2TG0wSHBWeXFvT09mci8rNUJDeHJUWjlJU3NFdTBSZTFX?= =?utf-8?B?dlBJY0tiRk5yM3o0QU5QYm1VQ0hpYnhRS2p0eUpRWHdmRFk5Z2dPQlJlV1hM?= =?utf-8?B?VDBDb2loTDBLbTY1Q3JwT3Q2TGNubDBMa01mOGRYQ2RwRlhCSFFCRHJVZ29y?= =?utf-8?B?V2dyRkluWFpHNjJVVXczVkZ0SWVLWmJLZFY5QVJwcFBteGdWU3RHZ09HclY4?= =?utf-8?B?R2dZUGJGTThrQ2dDanRlU3pWSm1EK1V1WUZmbFFXVHEwVzVsUmY3MjFyQUFw?= =?utf-8?B?bXB5Nk1xQTh1ZittL1c0bE1KZU11QkN3S2JES2htVDFnUXBQWS9ocGVSNG1i?= =?utf-8?B?NXYzWDFDSldnV0ovYllidmNXSUVQTEx1ZXYzaks1M3RjeGlTVEdsdGRFdlRT?= =?utf-8?B?N2wxZ2ZDaTNQRW9MenQ0Kyt5b1VPM0dnWFRXR0NQbmpqWGdEdmZLUWNiaHgx?= =?utf-8?B?Q1NKU0IwYXZpK0xXU0E3ZmNmNEVaRFNBUlFMWXd4ZEtTWExTQ2dUR1VTUkxm?= =?utf-8?B?d0FJc0JoYWRsaWpGcVpydzVnMGdFVWxzaUFnK2pLOEFmVGc3V3FkQnExSzRG?= =?utf-8?B?QkJmc3crdi9FUkhwZVlCaEJaR29YSUlUNXFoRlNURGZ4emtCcFJyNlZ6T2RP?= =?utf-8?B?dDFMVDRkci9PeVYrUGRaU0F2VmVxbTZ2MWlQVHE5SkppMnJwaXMwYzRnNjcv?= =?utf-8?B?dUVIQVBRYTE0ZWd0MkdqcHBReHNXT25UYmlpNzRoSVhwdnhZdHUyaDV3UjJK?= =?utf-8?B?NmowVllKWmErSDBRVTlRbW1BU0xTQk5uWnlkTEpCdFIwVFQwbnpyTFJrRThi?= =?utf-8?B?aUxyaTNIdUN2cGVBZHExNS9YYmxaQ010bzlUWU56bm5ULzdleWJIQ28wWUtV?= =?utf-8?B?S0RZRWpwcDZUQ1cyT2NuTkk0WHFXSjNSSkw4UGtPNHV1eDJueEFMMG1FNmFn?= =?utf-8?B?aGQrTzUwaFFtcUtVSVE2RE1YZ0tMUEFtVityRTJwaGtTUXIva3hCOHM2Yzdk?= =?utf-8?B?TnBDT0FjNGQxVzgvRWR5WmNYSzgxOTBYUXUzTzExM1o5VHVnSlNDMmFqeFNm?= =?utf-8?B?QzI3Z1h6TFFBRTRCdldNZSt0ME9qbHVZTDN5MW9NdENEbkpFdnpUYWVtTVk3?= =?utf-8?B?UDM3d3MrTHljMVh5Q2M5R2NWc1RLYjBQNXdoUWZXQU1TOUtOajNTM2NkNTlo?= =?utf-8?B?TVZUKzhoOFIyUG1zaVpLSUNNVnFsNGxoU1Q1Y2h1aFVJRkxTQVpsU0xXS1dr?= =?utf-8?B?OEtqVjdvOWIyc1Fsb0ZpbnJ0Wm9WNWxkSHJwMk5pZWRmVEcrc2hpc2dWS2FH?= =?utf-8?B?VzBNNXNselJIRVluQU4zRFM1YlUzbEsxT1NPSldHYnhLWWRJTHovWU16L01p?= =?utf-8?B?eHBJVFZUcmdDaWtjVXdlRk4xWUF0d0h1WDh4b0s0OHhpOVIvZkZhQ0xHMjVU?= =?utf-8?B?VWU5czM2K2x2VG5yemZDQlNzSjI3UWtDb2pxeEJjZkRCVTlYMGpjSWpYanh3?= =?utf-8?B?U3NabGNqemVRaXRMQjJaRW9BeWJMdzFEWEZUcXpIVzFDNUVpNnhCamRqSlVi?= =?utf-8?B?dVpOU00wS0FUcXk0QW5WOGszc0E4Q21kQXVYRkRtUnlvMHcxTjlpTElTcytX?= =?utf-8?B?dVVKaDZPb3RacGk0VU9qOUFWMzZRQTFTWWcwNnJmQjcwb2hZbm8wTEk3WXYr?= =?utf-8?B?WjJoYlVtUW5WaXU1Q0VkVkRFdGZXcjN3SVhrMlo5a0MybzE0SERJcnpkV05n?= =?utf-8?B?cjVBaU5kemlQL1grd0kxWHdBL2dMTElRaEU0MmI4MUpaUENhU21OWHBReTcz?= =?utf-8?B?UG95U0dGNlFKcEpxRVFvcW54RVM0TldoNTVoUzN2QnltRWFwR0FySTMxeE5m?= =?utf-8?B?NVc4RjdGQ2Y0azZjbGR0M29qMTdHY0czckZBblY0MFNKQk5nU1AvWDBhWTVy?= =?utf-8?B?YVhHTnVKNXoyYnFqM3pMWTJ3Q0svQWhNVitrS1A4SmVZenloQmg3RlJkYm1M?= =?utf-8?Q?S1avI+MjTGGB1gLsR/?= Content-Type: text/plain; charset="utf-8" Content-ID: <3D24E1824543384287F3B9822C5DB3A3@eurprd04.prod.outlook.com> Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: 1seal.org X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DBBPR04MB7673.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: f33fce6f-b59d-4ea0-4e8c-08de8e6dbbd3 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Mar 2026 15:05:08.6398 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: e701d992-0f02-433e-a019-4256abe96ea1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dix0V0QLU6xnSqCLJN1oU4piq2c2pStsS3iK2yuTOyD8OrUwryCxW/udOJ8hHTOUAgdr/yiGm8o+Dyxi72iqlg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: FRWPR04MB11103 The GRP_ACK_MSG handler in tipc_group_proto_rcv() unconditionally decrements grp->bc_ackers on every inbound group ACK, even when the sending member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a single duplicate ACK received after the legitimate set has drained the counter to zero wraps it to 65535. Once wrapped, tipc_group_bc_cong() permanently reports congestion, blocking all subsequent group broadcasts on the affected socket until the group is recreated. The member-removal path (tipc_group_delete_member) already handles this correctly: it only decrements bc_ackers when the counter is non-zero and the member still owes an ACK for the current broadcast round. Apply the same forward-progress guard to the GRP_ACK_MSG handler: only update m->bc_acked and decrement bc_ackers when the inbound ack value is strictly ahead of what has already been recorded for that member, and only decrement when bc_ackers is non-zero. Fixes: 75da2163dbb6 ("tipc: introduce communication groups") Cc: stable@vger.kernel.org Signed-off-by: Oleh Konko --- net/tipc/group.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index e0e6227b433..41fa7bb3091 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -745,7 +745,7 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool = *usr_wakeup, u32 node =3D msg_orignode(hdr); u32 port =3D msg_origport(hdr); struct tipc_member *m, *pm; - u16 remitted, in_flight; + u16 remitted, in_flight, acked; =20 if (!grp) return; @@ -798,8 +798,13 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool= *usr_wakeup, case GRP_ACK_MSG: if (!m) return; - m->bc_acked =3D msg_grp_bc_acked(hdr); - if (--grp->bc_ackers) + acked =3D msg_grp_bc_acked(hdr); + if (less(m->bc_acked, acked)) { + m->bc_acked =3D acked; + if (grp->bc_ackers) + grp->bc_ackers--; + } + if (grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open =3D true; --=20 2.50.0