netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Nikolay Aleksandrov <razor@blackwall.org>
To: netdev@vger.kernel.org
Cc: tobias@waldekranz.com, idosch@nvidia.com, kuba@kernel.org,
	davem@davemloft.net, bridge@lists.linux.dev, pabeni@redhat.com,
	edumazet@google.com, horms@kernel.org, petrm@nvidia.com,
	Nikolay Aleksandrov <razor@blackwall.org>
Subject: [PATCH net v2 0/2] net: bridge: fix two MST bugs
Date: Wed,  5 Nov 2025 13:19:17 +0200	[thread overview]
Message-ID: <20251105111919.1499702-1-razor@blackwall.org> (raw)

Hi,
Patch 01 fixes a race condition that exists between expired fdb deletion
and port deletion when MST is enabled. Learning can happen after the
port's state has been changed to disabled which could lead to that
port's memory being used after it's been freed. The issue was reported
by syzbot, more information in patch 01. Patch 02 fixes an issue with
MST's static key which Ido spotted, we can have multiple bridges with MST
and a single bridge can erroneously disable it for all.

v2: dropped the selftest as it is useless with the new fix
    patch 01 - new fix approach relying on port's vlan group
    patch 02 - new patch fixing an issue with MST's static key

Thanks,
 Nik

Nikolay Aleksandrov (2):
  net: bridge: fix use-after-free due to MST port state bypass
  net: bridge: fix MST static key usage

 net/bridge/br_forward.c |  2 +-
 net/bridge/br_if.c      |  1 +
 net/bridge/br_input.c   |  4 ++--
 net/bridge/br_mst.c     | 10 ++++++++--
 net/bridge/br_private.h | 13 ++++++++++---
 5 files changed, 22 insertions(+), 8 deletions(-)

-- 
2.51.0


             reply	other threads:[~2025-11-05 11:20 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-11-05 11:19 Nikolay Aleksandrov [this message]
2025-11-05 11:19 ` [PATCH net v2 1/2] net: bridge: fix use-after-free due to MST port state bypass Nikolay Aleksandrov
2025-11-05 16:59   ` Ido Schimmel
2025-11-05 11:19 ` [PATCH net v2 2/2] net: bridge: fix MST static key usage Nikolay Aleksandrov
2025-11-05 17:04   ` Ido Schimmel
2025-11-06 15:40 ` [PATCH net v2 0/2] net: bridge: fix two MST bugs patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251105111919.1499702-1-razor@blackwall.org \
    --to=razor@blackwall.org \
    --cc=bridge@lists.linux.dev \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=idosch@nvidia.com \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=petrm@nvidia.com \
    --cc=tobias@waldekranz.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).