From: Nikolay Aleksandrov <razor@blackwall.org>
To: netdev@vger.kernel.org
Cc: tobias@waldekranz.com, idosch@nvidia.com, kuba@kernel.org,
davem@davemloft.net, bridge@lists.linux.dev, pabeni@redhat.com,
edumazet@google.com, horms@kernel.org, petrm@nvidia.com,
Nikolay Aleksandrov <razor@blackwall.org>
Subject: [PATCH net v2 0/2] net: bridge: fix two MST bugs
Date: Wed, 5 Nov 2025 13:19:17 +0200 [thread overview]
Message-ID: <20251105111919.1499702-1-razor@blackwall.org> (raw)
Hi,
Patch 01 fixes a race condition that exists between expired fdb deletion
and port deletion when MST is enabled. Learning can happen after the
port's state has been changed to disabled which could lead to that
port's memory being used after it's been freed. The issue was reported
by syzbot, more information in patch 01. Patch 02 fixes an issue with
MST's static key which Ido spotted, we can have multiple bridges with MST
and a single bridge can erroneously disable it for all.
v2: dropped the selftest as it is useless with the new fix
patch 01 - new fix approach relying on port's vlan group
patch 02 - new patch fixing an issue with MST's static key
Thanks,
Nik
Nikolay Aleksandrov (2):
net: bridge: fix use-after-free due to MST port state bypass
net: bridge: fix MST static key usage
net/bridge/br_forward.c | 2 +-
net/bridge/br_if.c | 1 +
net/bridge/br_input.c | 4 ++--
net/bridge/br_mst.c | 10 ++++++++--
net/bridge/br_private.h | 13 ++++++++++---
5 files changed, 22 insertions(+), 8 deletions(-)
--
2.51.0
next reply other threads:[~2025-11-05 11:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-05 11:19 Nikolay Aleksandrov [this message]
2025-11-05 11:19 ` [PATCH net v2 1/2] net: bridge: fix use-after-free due to MST port state bypass Nikolay Aleksandrov
2025-11-05 16:59 ` Ido Schimmel
2025-11-05 11:19 ` [PATCH net v2 2/2] net: bridge: fix MST static key usage Nikolay Aleksandrov
2025-11-05 17:04 ` Ido Schimmel
2025-11-06 15:40 ` [PATCH net v2 0/2] net: bridge: fix two MST bugs patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251105111919.1499702-1-razor@blackwall.org \
--to=razor@blackwall.org \
--cc=bridge@lists.linux.dev \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petrm@nvidia.com \
--cc=tobias@waldekranz.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).