From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D162955C1C3; Mon, 31 Aug 2026 13:47:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788184055; cv=none; b=ALZQHoJq+gmcU601R+Ln99X45G58+MSX4AGmLoewXhFlqm07U/YQAKdHHwgtGxSFRQcwLAPS0xUkSL5p8TP6VhOjtzz4+WE9TjQoPpjiMDXiFdI90Lsgrx+AHFfX9Yp7g/p6pcVColbh2hmk7E75gB3XJ9IKst1iQh2Ew4i5LkE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788184055; c=relaxed/simple; bh=rSN5ldXBMl6eqvBxg7dbErviDfu2aaJ2OvSluapfGow=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ingoxbDcmqazKbF9gKzMS2J49YGXqYPic9SfZYxfvRo5dL+B4VPKl0SSzVBdueYMdDFsQfzIQWZud0YkJnH+NzLOwBagJXnlQOfDifUS7mTnv64KKw9zL6/cHtb3yKvMOPhvV/dxbBNgBlTmjVpULdcT21ak7dzfWz01/RB7zFI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hhzq/vUk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hhzq/vUk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 377EF1F00A3D; Mon, 31 Aug 2026 13:47:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788184053; bh=NIMBX7rx/GutF3hVwM3E9LPIZeHo+9Ry5phihrjT89c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hhzq/vUkTirKlS4la0apwmySDR6kLKJTsttpquNjbzfSo1mdfEivOzCQ6/j4ml3sQ 7ZGfLTy+BTxmFvRXM0qR1DmfFzjJCp9k4Pph0bICmBpeNeG8RT0T4uCa4vLjLKpm/J YjQcfWn1UStPC+YQhBSsGhXFwBsi46kz1FEVevPY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Norbert Szetei , Nikolay Aleksandrov , Jakub Kicinski Subject: [PATCH 6.18 57/83] net: bridge: mcast: fix use-after-free of a master VLANs multicast context Date: Mon, 31 Aug 2026 15:34:33 +0200 Message-ID: <20260831133402.435560058@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260831133359.207714926@linuxfoundation.org> References: <20260831133359.207714926@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Norbert Szetei commit 50e5c6605cc9c2dd57bd2d1b3459674d19738983 upstream. br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's multicast context. That is the teardown handshake: lockless readers gate on the flag through br_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so once it is cleared under the lock no reader can arm the context again. For a master VLAN the handshake never runs. __vlan_del() clears BRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so br_multicast_toggle_one_vlan(masterv, false) returns early on !br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is never taken. br_vlan_put_master() then drains the context in br_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a reader still inside rcu_read_lock() sees the context as enabled and re-arms it. The port and port-VLAN branch of the function has no br_vlan_is_brentry() test and flips the flag under br->multicast_lock, so it is not affected. The reader is the bridge transmit path. For a master VLAN br_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with pmctx = NULL, so IGMP sent to the bridge device re-arms the context's timers after br_multicast_ctx_deinit() has already stopped them. BUG: KASAN: slab-use-after-free in detach_if_pending+0x412/0x4a0 Write of size 8 at addr ffff88810ac39918 by task brmc/601 __mod_timer+0x51a/0xc50 br_multicast_host_join+0x25b/0x390 __br_multicast_add_group+0x468/0x530 br_ip4_multicast_add_group+0x1a0/0x260 br_multicast_rcv+0x2cda/0x61e0 br_dev_xmit+0x6c4/0x1540 Allocated by task 610: br_vlan_add+0x111/0xb40 br_vlan_info+0x370/0x3e0 Freed by task 0: kfree+0x1a7/0x4f0 rcu_core+0x7dc/0x10a0 Only test br_vlan_is_brentry() when enabling, like the br_multicast_ctx_vlan_global_disabled() test next to it. Disabling then always clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before br_multicast_ctx_deinit() drains the context. Fixes: 7b54aaaf53cb ("net: bridge: multicast: add vlan state initialization and control") Cc: stable@vger.kernel.org Signed-off-by: Norbert Szetei Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/D400F6C7-543A-4B79-9E5B-D1D8974DE5C9@doyensec.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_multicast.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -4311,8 +4311,8 @@ void br_multicast_toggle_one_vlan(struct if (br_vlan_is_master(vlan)) { br = vlan->br; - if (!br_vlan_is_brentry(vlan) || - (on && + if (on && + (!br_vlan_is_brentry(vlan) || br_multicast_ctx_vlan_global_disabled(&vlan->br_mcast_ctx))) return;