Re: [PATCH net] net: bridge: Reject descending VLAN tunnel ranges

[Nikolay Aleksandrov <razor@blackwall.org>]

On 14/08/2026 16:40, Ruoyu Wang wrote:
> A pair of descending VLAN and tunnel IDs can pass the tunnel range span
> check. The VLAN subtraction produces a negative int, which is converted
> to unsigned when compared with the u32 tunnel ID subtraction. It can
> therefore equal the wrapped tunnel ID delta.
> 
> The range loop then performs no iterations. Since the batched
> notification handling added a post-loop error check, this leaves err
> uninitialized and makes the request's return value unpredictable.
> 
> Reject descending VLAN ranges before comparing the spans. Valid
> ascending and single-entry ranges remain unchanged, while malformed
> descending ranges consistently return -EINVAL.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 94339443686b ("net: bridge: notify on vlan tunnel changes done via the old api")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>   net/bridge/br_netlink_tunnel.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/bridge/br_netlink_tunnel.c b/net/bridge/br_netlink_tunnel.c
> index 71a12da30004c..05f560eeb789c 100644
> --- a/net/bridge/br_netlink_tunnel.c
> +++ b/net/bridge/br_netlink_tunnel.c
> @@ -301,7 +301,8 @@ int br_process_vlan_tunnel_info(const struct net_bridge *br,
>   
>   		if (!(tinfo_last->flags & BRIDGE_VLAN_INFO_RANGE_BEGIN))
>   			return -EINVAL;
> -		if ((tinfo_curr->vid - tinfo_last->vid) !=
> +		if (tinfo_curr->vid < tinfo_last->vid ||
> +		    (tinfo_curr->vid - tinfo_last->vid) !=
>   		    (tinfo_curr->tunid - tinfo_last->tunid))
>   			return -EINVAL;
>   		t = tinfo_last->tunid;

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>