[PATCH 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[PATCH 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

Hi,

This fixes the syzbot report "WARNING in nf_ct_bridge_post":

  https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f

It has been open since November 2025 and has a C reproducer.

With vlan_filtering on, a frame whose tag protocol differs from the
bridge's vlan_protocol (802.1Q on an 802.1ad bridge, or the other way
round) gets its tag moved back into the packet after bridge conntrack
has defragmented it. In postrouting nf_ct_bridge_refrag() no longer
recognises the protocol, warns and drops it.

The warning is only part of it. Fragmented IPv4 and IPv6 packets through
such a bridge are dropped, everything else works, so it looks like an MTU
problem: a 3000 byte ping in an 802.1Q vlan across an 802.1ad bridge with
bridge conntrack gets no reply, across an 802.1Q bridge it does.

Patch 1 skips over the tag in nf_ct_bridge_refrag() and puts it back on
each fragment. Patch 2 adds a selftest for it.

The Fixes: tags in patch 1 are the initial bridge conntrack support and
its IPv6 support, both from v5.3.

I tested this in QEMU guests on 7.3 and on v5.4, v6.1, v6.12 and v7.2, on
arm64 and on x86_64 with KVM. The selftest fails on all of them without
patch 1 (the control passes, the six other pings fail and the kernel
warns) and passes with it. The frame from the syzbot reproducer warns
without patch 1 and does not with it.

On a kernel with KASAN, lockdep, DEBUG_ATOMIC_SLEEP, kmemleak and
DEBUG_NET the selftest shows nothing, and neither do packets whose inner
ethertype an nft postrouting rule rewrites after defragmentation (to ARP,
and IPv4/IPv6 labelled as each other): they are dropped without a warning
or a leak. It builds without warnings with W=1 and CONFIG_IPV6=n or
CONFIG_BRIDGE_VLAN_FILTERING=n, and checkpatch.pl --strict is clean.

A tagged egress port (hardware tag together with the in-band tag), jumbo
frames, and br_netfilter enabled together with bridge conntrack were also
run: all fail on the unpatched kernel and pass with patch 1, except a
smaller egress mtu, where the 802.1Q bridge behaves the same.

Thanks,
Laveesh

Laveesh Bansal (2):
  netfilter: bridge: refragment packets with a vlan tag moved by the
    bridge
  selftests: netfilter: add bridge conntrack test for vlan protocol
    mismatch

 include/linux/netfilter_bridge.h              |   4 +
 net/bridge/netfilter/nf_conntrack_bridge.c    |  43 ++++-
 .../testing/selftests/net/netfilter/Makefile  |   1 +
 .../net/netfilter/bridge_ct_vlan_proto.sh     | 182 ++++++++++++++++++
 tools/testing/selftests/net/netfilter/config  |   1 +
 5 files changed, 227 insertions(+), 4 deletions(-)
 create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh

-- 
2.54.0 (Apple Git-157)

[PATCH 1/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

With vlan_filtering enabled, br_allowed_ingress() moves the vlan tag back
into the packet when its protocol differs from the bridge's vlan_protocol,
an 802.1Q tag on an 802.1ad bridge for instance, and sets skb->protocol to
the vlan ethertype. That happens after the NF_BR_PRE_ROUTING hooks.

Bridge conntrack has already defragmented the packet by then, based on the
original protocol. In postrouting nf_ct_bridge_refrag() finds a vlan
ethertype it cannot fragment, warns and drops the packet:

 WARNING: net/bridge/netfilter/nf_conntrack_bridge.c:361 at nf_ct_bridge_post
 Call trace:
  nf_ct_bridge_post
  nf_hook_slow
  br_forward_finish
  __br_forward
  deliver_clone
  br_flood
  br_handle_frame_finish
  br_handle_frame

The warning is the smaller problem. Every fragmented IPv4 or IPv6 packet
that crosses such a bridge is dropped while unfragmented traffic is fine,
so it looks like an MTU issue. And anyone who can send fragments into a
port of such a bridge can trigger the warning, which takes the machine
down with panic_on_warn.

Look past the vlan tag in nf_ct_bridge_refrag(): remember it, pull it,
fragment as before and push it back onto each fragment in
nf_ct_bridge_frag_restore(), together with the outer protocol, so that
br_dev_queue_push_xmit() sees the fragments like any other tagged frame.
The protocol behind the tag comes from the packet, so check it against the
header before fragmenting.

Removing the WARN_ON_ONCE() would only hide the problem, the packets would
still be dropped. Not tracking these frames in nf_ct_bridge_pre() instead
would change what is tracked today for unfragmented traffic, and would have
to duplicate the decision that br_allowed_ingress() makes later.

The syzbot reproducer is an IPv6 atomic fragment with a frag_max_size of
60, which br_ip6_fragment() drops silently because it is below
IPV6_MIN_MTU. It no longer warns either.

Reported-by: syzbot+a8ba738fe2db6b4bb27f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f
Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
---
 include/linux/netfilter_bridge.h           |  4 ++
 net/bridge/netfilter/nf_conntrack_bridge.c | 43 ++++++++++++++++++++--
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 743475ca7e9d..7091e01abe77 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -10,6 +10,10 @@ struct nf_bridge_frag_data {
 	bool    vlan_present;
 	u16     vlan_tci;
 	__be16  vlan_proto;
+	bool    inband_vlan_present;
+	u16     inband_vlan_tci;
+	__be16  inband_vlan_proto;
+	__be16  inband_vlan_encap_proto;
 };
 
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index b5444335b86f..e16071eb2df0 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -344,13 +344,41 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state,
 				  const struct nf_bridge_frag_data *data,
 				  struct sk_buff *))
 {
-	struct nf_bridge_frag_data data;
+	struct nf_bridge_frag_data data = {};
+	__be16 proto = skb->protocol;
 
 	if (!BR_INPUT_SKB_CB(skb)->frag_max_size)
 		return NF_ACCEPT;
 
 	nf_ct_bridge_frag_save(skb, &data);
-	switch (skb->protocol) {
+
+	/* A vlan filtering bridge moves a vlan tag into the packet if its
+	 * protocol differs from the bridge's vlan_protocol, after prerouting
+	 * defragmented the packet. Look past that tag.
+	 */
+	if (eth_type_vlan(proto)) {
+		const struct vlan_hdr *vhdr;
+
+		if (skb_network_offset(skb) != VLAN_HLEN ||
+		    !pskb_may_pull(skb, VLAN_HLEN))
+			return NF_DROP;
+
+		vhdr = (const struct vlan_hdr *)skb->data;
+		data.inband_vlan_present = true;
+		data.inband_vlan_tci = ntohs(vhdr->h_vlan_TCI);
+		data.inband_vlan_proto = proto;
+		data.inband_vlan_encap_proto = vhdr->h_vlan_encapsulated_proto;
+
+		proto = data.inband_vlan_encap_proto;
+		__skb_pull(skb, VLAN_HLEN);
+		skb->protocol = proto;
+
+		if ((proto == htons(ETH_P_IP) && ip_hdr(skb)->version != 4) ||
+		    (proto == htons(ETH_P_IPV6) && ipv6_hdr(skb)->version != 6))
+			return NF_DROP;
+	}
+
+	switch (proto) {
 	case htons(ETH_P_IP):
 		nf_br_ip_fragment(state->net, state->sk, skb, &data, output);
 		break;
@@ -358,7 +386,7 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state,
 		nf_br_ip6_fragment(state->net, state->sk, skb, &data, output);
 		break;
 	default:
-		WARN_ON_ONCE(1);
+		WARN_ON_ONCE(!data.inband_vlan_present);
 		return NF_DROP;
 	}
 
@@ -371,11 +399,18 @@ static int nf_ct_bridge_frag_restore(struct sk_buff *skb,
 {
 	int err;
 
-	err = skb_cow_head(skb, ETH_HLEN);
+	err = skb_cow_head(skb, ETH_HLEN + (data->inband_vlan_present ? VLAN_HLEN : 0));
 	if (err) {
 		kfree_skb(skb);
 		return -ENOMEM;
 	}
+	if (data->inband_vlan_present) {
+		struct vlan_hdr *vhdr = skb_push(skb, VLAN_HLEN);
+
+		vhdr->h_vlan_TCI = htons(data->inband_vlan_tci);
+		vhdr->h_vlan_encapsulated_proto = data->inband_vlan_encap_proto;
+		skb->protocol = data->inband_vlan_proto;
+	}
 	if (data->vlan_present)
 		__vlan_hwaccel_put_tag(skb, data->vlan_proto, data->vlan_tci);
 	else if (skb_vlan_tag_present(skb))
-- 
2.54.0 (Apple Git-157)

[PATCH 2/2] selftests: netfilter: add bridge conntrack test for vlan protocol mismatch

[Laveesh Bansal]

Add a test for fragmented packets in vlans that are forwarded by a vlan
filtering bridge with bridge conntrack.

If the protocol of the vlan tag differs from the vlan_protocol of the
bridge, the bridge moves the tag into the packet after prerouting, which
made bridge conntrack warn and drop the fragments. The test uses an 802.1Q
vlan on an 802.1ad bridge and the reverse, and an 802.1Q vlan on an 802.1Q
bridge as control.

Send fragmented IPv4 and IPv6 pings through the bridge and check that they
get through, that conntrack reassembled them and that the kernel did not
warn. Repeat the first mismatching case with promisc set on the bridge,
which makes it forward clones of the packets, so that fragmenting them
takes the slow path.

Assisted-by: LLM
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
---
 .../testing/selftests/net/netfilter/Makefile  |   1 +
 .../net/netfilter/bridge_ct_vlan_proto.sh     | 182 ++++++++++++++++++
 tools/testing/selftests/net/netfilter/config  |   1 +
 3 files changed, 184 insertions(+)
 create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh

diff --git a/tools/testing/selftests/net/netfilter/Makefile b/tools/testing/selftests/net/netfilter/Makefile
index f88dd4ef8d26..314f678f3dfc 100644
--- a/tools/testing/selftests/net/netfilter/Makefile
+++ b/tools/testing/selftests/net/netfilter/Makefile
@@ -10,6 +10,7 @@ TEST_PROGS := \
 	br_netfilter.sh \
 	br_netfilter_queue.sh \
 	bridge_brouter.sh \
+	bridge_ct_vlan_proto.sh \
 	conntrack_clash.sh \
 	conntrack_dump_flush.sh \
 	conntrack_icmp_related.sh \
diff --git a/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh b/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
new file mode 100755
index 000000000000..19f842e17060
--- /dev/null
+++ b/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
@@ -0,0 +1,182 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# A VLAN filtering bridge moves the vlan tag of a frame into the packet if the
+# protocol of the tag differs from the vlan_protocol of the bridge, after the
+# bridge prerouting hooks have run. skb->protocol is a vlan ethertype when the
+# postrouting hooks see the frame.
+#
+# Bridge conntrack defragments IP packets in prerouting and fragments them
+# again in postrouting. It used to warn and drop fragmented packets that are
+# forwarded like this.
+#
+# Send fragmented ping packets in vlans through a bridge with bridge conntrack
+# and check that they are forwarded, that they were reassembled by conntrack
+# and that the kernel does not warn.
+#
+#                       ns0 (br0)
+#   ns1 eth0.100 -- veth0 ------- veth1 -- eth1.100 ns2
+
+source lib.sh
+
+# TAINT_WARN
+taint_warn=512
+
+checktool "nft --version" "run test without nft tool"
+checktool "bridge -V" "run test without bridge tool"
+checktool "ping -V" "run test without ping"
+
+read -r t < /proc/sys/kernel/tainted
+if [ $((t & taint_warn)) -ne 0 ]; then
+	echo "SKIP: kernel has already warned"
+	exit "$ksft_skip"
+fi
+
+cleanup() {
+	cleanup_all_ns
+}
+
+trap cleanup EXIT
+
+ret=0
+
+# $1: vlan_protocol of the bridge, $2: protocol of the vlan devices
+setup()
+{
+	local br_proto="$1"
+	local vlan_proto="$2"
+
+	setup_ns ns0 ns1 ns2
+
+	ip -net "$ns0" link add br0 type bridge vlan_filtering 1 \
+		vlan_protocol "$br_proto" || return "$ksft_skip"
+	ip -net "$ns0" link add veth0 type veth peer name eth0 netns "$ns1" || return "$ksft_skip"
+	ip -net "$ns0" link add veth1 type veth peer name eth1 netns "$ns2" || return "$ksft_skip"
+
+	for i in 0 1; do
+		ip -net "$ns0" link set "veth$i" master br0
+		ip -net "$ns0" link set "veth$i" up
+		# If the protocols match, vlan 100 has to be allowed. If not,
+		# the bridge treats the tag as part of the packet.
+		if [ "$br_proto" = "802.1q" ] && [ "$vlan_proto" = "802.1q" ]; then
+			ip netns exec "$ns0" bridge vlan add dev "veth$i" vid 100 ||
+				return "$ksft_skip"
+		fi
+	done
+	ip -net "$ns0" link set br0 up
+
+	ip -net "$ns1" link set eth0 up
+	ip -net "$ns2" link set eth1 up
+
+	ip -net "$ns1" link add link eth0 name eth0.100 type vlan \
+		protocol "$vlan_proto" id 100 || return "$ksft_skip"
+	ip -net "$ns2" link add link eth1 name eth1.100 type vlan \
+		protocol "$vlan_proto" id 100 || return "$ksft_skip"
+
+	ip -net "$ns1" link set eth0.100 mtu 1400 up
+	ip -net "$ns2" link set eth1.100 mtu 1400 up
+
+	ip -net "$ns1" addr add 10.0.100.1/24 dev eth0.100
+	ip -net "$ns2" addr add 10.0.100.2/24 dev eth1.100
+	ip -net "$ns1" addr add dead:100::1/64 dev eth0.100 nodad
+	ip -net "$ns2" addr add dead:100::2/64 dev eth1.100 nodad
+
+	# Loading a ct rule in the bridge family enables bridge conntrack. The
+	# postrouting counter sees the packets reassembled by conntrack.
+	ip netns exec "$ns0" nft -f - <<EOF || return "$ksft_skip"
+table bridge t {
+	chain pre {
+		type filter hook prerouting priority 0; policy accept;
+		ct state new counter
+	}
+	chain post {
+		type filter hook postrouting priority 0; policy accept;
+		meta length > 1400 counter
+	}
+}
+EOF
+
+	return 0
+}
+
+# $1: vlan_protocol of the bridge, $2: protocol of the vlan devices,
+# $3: "clone" to make the bridge forward clones, which makes fragmenting take
+#     the slow path
+run_case()
+{
+	local desc="$2 vlan on $1 bridge${3:+, $3}"
+	local rc=0
+
+	setup "$1" "$2"
+	rc=$?
+	if [ "$rc" -ne 0 ]; then
+		echo "SKIP: could not set up $desc"
+		return "$rc"
+	fi
+
+	if [ "$3" = "clone" ]; then
+		# The bridge delivers a clone of the packets it forwards if it
+		# also receives them.
+		ip -net "$ns0" link set br0 promisc on
+	fi
+
+	# Wait until the bridge forwards the plain vlan traffic.
+	if ! busywait 5000 ip netns exec "$ns1" ping -c 1 -W 1 -q 10.0.100.2 >/dev/null 2>&1; then
+		echo "FAIL: no connectivity through the bridge, $desc"
+		cleanup_all_ns
+		return 1
+	fi
+
+	# 3000 bytes of icmp payload do not fit the 1400 byte mtu, the sender
+	# fragments the packets and bridge conntrack reassembles and fragments
+	# them again.
+	for ip in 10.0.100.2 dead:100::2; do
+		if ip netns exec "$ns1" ping -c 3 -W 2 -s 3000 -q "$ip" >/dev/null; then
+			echo "PASS: fragmented ping to $ip, $desc"
+		else
+			echo "FAIL: fragmented ping to $ip, $desc"
+			rc=1
+		fi
+	done
+
+	if ! ip netns exec "$ns0" nft list chain bridge t post | grep -q "packets [1-9]"; then
+		echo "FAIL: conntrack did not reassemble the packets, $desc"
+		rc=1
+	fi
+
+	cleanup_all_ns
+
+	return $rc
+}
+
+run_all()
+{
+	local rc
+
+	# bridge protocol, protocol of the vlan devices
+	for case in "802.1q 802.1q" "802.1ad 802.1q" "802.1q 802.1ad" "802.1ad 802.1q clone"; do
+		# shellcheck disable=SC2086
+		run_case $case
+		rc=$?
+		if [ "$rc" -eq "$ksft_skip" ]; then
+			return "$ksft_skip"
+		fi
+		[ "$rc" -ne 0 ] && ret=1
+	done
+
+	return 0
+}
+
+run_all
+rc=$?
+if [ "$rc" -eq "$ksft_skip" ] && [ "$ret" -eq 0 ]; then
+	exit "$ksft_skip"
+fi
+
+read -r t < /proc/sys/kernel/tainted
+if [ $((t & taint_warn)) -ne 0 ]; then
+	echo "FAIL: kernel warned"
+	ret=1
+fi
+
+exit $ret
diff --git a/tools/testing/selftests/net/netfilter/config b/tools/testing/selftests/net/netfilter/config
index c3c121b6f300..e91bb10d1072 100644
--- a/tools/testing/selftests/net/netfilter/config
+++ b/tools/testing/selftests/net/netfilter/config
@@ -62,6 +62,7 @@ CONFIG_NET_SCH_HTB=m
 CONFIG_NET_SCH_NETEM=m
 CONFIG_NET_VRF=y
 CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_MARK=y
-- 
2.54.0 (Apple Git-157)

Re: [PATCH 1/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Pablo Neira Ayuso]

On Mon, Oct 19, 2026 at 05:54:03PM -0700, Laveesh Bansal wrote:
> With vlan_filtering enabled, br_allowed_ingress() moves the vlan tag back
> into the packet when its protocol differs from the bridge's vlan_protocol,
> an 802.1Q tag on an 802.1ad bridge for instance, and sets skb->protocol to
> the vlan ethertype. That happens after the NF_BR_PRE_ROUTING hooks.
> 
> Bridge conntrack has already defragmented the packet by then, based on the
> original protocol. In postrouting nf_ct_bridge_refrag() finds a vlan
> ethertype it cannot fragment, warns and drops the packet:
> 
>  WARNING: net/bridge/netfilter/nf_conntrack_bridge.c:361 at nf_ct_bridge_post
>  Call trace:
>   nf_ct_bridge_post
>   nf_hook_slow
>   br_forward_finish
>   __br_forward
>   deliver_clone
>   br_flood
>   br_handle_frame_finish
>   br_handle_frame
> 
> The warning is the smaller problem. Every fragmented IPv4 or IPv6 packet
> that crosses such a bridge is dropped while unfragmented traffic is fine,
> so it looks like an MTU issue. And anyone who can send fragments into a
> port of such a bridge can trigger the warning, which takes the machine
> down with panic_on_warn.
> 
> Look past the vlan tag in nf_ct_bridge_refrag(): remember it, pull it,
> fragment as before and push it back onto each fragment in
> nf_ct_bridge_frag_restore(), together with the outer protocol, so that
> br_dev_queue_push_xmit() sees the fragments like any other tagged frame.
> The protocol behind the tag comes from the packet, so check it against the
> header before fragmenting.
> 
> Removing the WARN_ON_ONCE() would only hide the problem, the packets would
> still be dropped. Not tracking these frames in nf_ct_bridge_pre() instead
> would change what is tracked today for unfragmented traffic, and would have
> to duplicate the decision that br_allowed_ingress() makes later.

Yes, but let's just fix this by turning this into a
DEBUG_NET_WARN_ON_ONCE(1) and let the packet be dropped.

Then, we can follow up to fill the gap for this feature in in nf-next.