From: Ido Schimmel <idosch@nvidia.com>
To: Zijing Yin <yzjaurora@gmail.com>
Cc: netdev@vger.kernel.org, bridge@lists.linux.dev,
razor@blackwall.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
nathan@kernel.org, nick.desaulniers+lkml@gmail.com,
morbo@google.com, justinstitt@google.com, petrm@nvidia.com,
linux-kernel@vger.kernel.org, llvm@lists.linux.dev
Subject: Re: [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group
Date: Fri, 3 Apr 2026 12:56:29 +0300 [thread overview]
Message-ID: <20260403095629.GA65129@shredder> (raw)
In-Reply-To: <20260402140153.3925663-1-yzjaurora@gmail.com>
On Thu, Apr 02, 2026 at 07:01:53AM -0700, Zijing Yin wrote:
> When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and
> nbp_vlan_group() return NULL (br_private.h stub definitions). The
> BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and
> reaches br_fdb_delete_locals_per_vlan_port() and
> br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer
> is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).
>
> The observed crash is in the delete path, triggered when creating a
> bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0
> via RTM_NEWLINK. The insert helper has the same bug pattern.
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI
> KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
> RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310
> Call Trace:
> br_fdb_toggle_local_vlan_0+0x452/0x4c0
> br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276
> br_boolopt_toggle net/bridge/br.c:313
> br_boolopt_multi_toggle net/bridge/br.c:364
> br_changelink net/bridge/br_netlink.c:1542
> br_dev_newlink net/bridge/br_netlink.c:1575
>
> Add NULL checks for the vlan group pointer in both helpers, returning
> early when there are no VLANs to iterate. This matches the existing
> pattern used by other bridge FDB functions such as br_fdb_add() and
> br_fdb_delete().
>
> Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0")
> Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
next prev parent reply other threads:[~2026-04-03 9:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-02 14:01 [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group Zijing Yin
2026-04-03 9:56 ` Ido Schimmel [this message]
2026-04-03 14:59 ` Nikolay Aleksandrov
2026-04-03 22:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260403095629.GA65129@shredder \
--to=idosch@nvidia.com \
--cc=bridge@lists.linux.dev \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=justinstitt@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=morbo@google.com \
--cc=nathan@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nick.desaulniers+lkml@gmail.com \
--cc=pabeni@redhat.com \
--cc=petrm@nvidia.com \
--cc=razor@blackwall.org \
--cc=yzjaurora@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox