Re: [PATCH net 1/1] net: bridge: stop fast-leave after deleting a port group

[Nikolay Aleksandrov <razor@blackwall.org>]

On Fri, Jul 24, 2026 at 12:52:48AM +0800, Ren Wei wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> br_multicast_leave_group() iterates mp->ports with pp = &p->next in
> its fast-leave path. After br_multicast_del_pg() removes p,
> continuing the loop advances pp through the deleted entry.
> 
> If multicast-to-unicast was enabled, the bridge can hold multiple port
> groups for the same port and group with different source MAC
> addresses. Once multicast-to-unicast is disabled,
> br_port_group_equal() matches those entries by port only. A fast leave
> can then delete one entry and continue from its stale next pointer,
> leaving mp->ports pointing at a deleted port group.
> 
> Fast leave only needs to remove one matching port group. Break after
> br_multicast_del_pg() so the loop stops before dereferencing the
> removed entry.
> 
> Fixes: 6db6f0eae605 ("bridge: multicast to unicast")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> Signed-off-by: Ren Wei <enjou1224z@gmail.com>
> ---
>  net/bridge/br_multicast.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
> index 6b3ac473fd22..00aa9b2879d6 100644
> --- a/net/bridge/br_multicast.c
> +++ b/net/bridge/br_multicast.c
> @@ -3687,6 +3687,7 @@ br_multicast_leave_group(struct net_bridge_mcast *brmctx,
>  
>  			p->flags |= MDB_PG_FLAGS_FAST_LEAVE;
>  			br_multicast_del_pg(mp, p, pp);
> +			break;
>  		}
>  		goto out;
>  	}
> -- 
> 2.43.0
> 

Yeah, all other places which use br_port_group_equal do exactly that
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>