Exits after returned mld_type == 0, triggered by received UDP multicast packets

[T-X]

In MLDv2 mode I'm somehow hitting the "if (mld6_recvlen < 0)" check in mld6_read(). Which then results in pim6sd shutting down.

Debugging output when this happens shows:

• rcvmh.msg_name: fe80::ba:7aff:fedf:406
• mld_recvlen: 80

The 80 bytes from recvmsg() look like this, where the first one is indeed 0x00:

00 01 01 00 00 00 00 00 fe 80 00 00 00 00 00 00
00 ba 7a ff fe df 04 06 ff 05 00 00 00 00 00 00
00 00 00 00 00 02 10 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

With some ebtables blocking I could narrow it down to the following IPv6 UDP packet:

$ tcpdump -x -i eth0 "ip6 src fe80::ba:7aff:fedf:406 and inbound"
01:47:30.028003 IP6 fe80::ba:7aff:fedf:406.56078 > ff05::2:1001.1001: UDP, length 34
        0x0000:  600c 55af 002a 1101 fe80 0000 0000 0000
        0x0010:  00ba 7aff fedf 0406 ff05 0000 0000 0000
        0x0020:  0000 0000 0002 1001 db0e 03e9 002a db12
        0x0030:  4745 5420 6e6f 6465 696e 666f 2073 7461
        0x0040:  7469 7374 6963 7320 6e65 6967 6862 6f75
        0x0050:  7273

udp-mcast2.cap.txt

However this does not seem fully match the previous buffer received from recvmsg()?

So far this somehow looks a bit like a Linux kernel bug to me, as we explicitly set the socket as SOCK_RAW for IPPROTO_ICMPV6, which should exclude UDP.

I'm also wondering if there might be a way to check for ICMPv6 explicitly from what recvmsg() returns to exclude the UDP packet responses. But so far the returned buffer looks like (mostly) garbage?

root@ffhl-pim6-router:~# uname -a
Linux ffhl-pim6-router 6.5.11-8-pve #1 SMP PREEMPT_DYNAMIC PMX 6.5.11-8 (2024-01-30T12:27Z) x86_64 GNU/Linux