From: Ido Schimmel <idosch@nvidia.com>
To: netdev@vger.kernel.org, bridge@lists.linux-foundation.org
Cc: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com,
edumazet@google.com, razor@blackwall.org, horms@kernel.org,
dsahern@kernel.org, yongwang@nvidia.com, aroulin@nvidia.com,
petrm@nvidia.com, tglx@kernel.org,
Ido Schimmel <idosch@nvidia.com>
Subject: [PATCH net 0/2] bridge: mcast: Fix a possible use-after-free when removing a bridge port
Date: Sun, 17 May 2026 15:11:20 +0300 [thread overview]
Message-ID: <20260517121122.188333-1-idosch@nvidia.com> (raw)
Patch #1 fixes a possible use-after-free when removing a bridge port.
Patch #2 adds a test case that triggers the problem.
In net-next we can:
1. Add DEBUG_NET_WARN_ON_ONCE() when a port multicast context is
de-initialized while enabled.
2. When de-initializing a port multicast context, synchronously shutdown
all the timers that were initialized when the context was initialized.
Ido Schimmel (2):
bridge: mcast: Fix a possible use-after-free when removing a bridge
port
selftests: bridge_vlan_mcast: Test toggling of multicast snooping
net/bridge/br_multicast.c | 22 ++++++++++----
.../net/forwarding/bridge_vlan_mcast.sh | 30 ++++++++++++++++++-
2 files changed, 46 insertions(+), 6 deletions(-)
--
2.54.0
next reply other threads:[~2026-05-17 12:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-17 12:11 Ido Schimmel [this message]
2026-05-17 12:11 ` [PATCH net 1/2] bridge: mcast: Fix a possible use-after-free when removing a bridge port Ido Schimmel
2026-05-19 9:31 ` Ido Schimmel
2026-05-17 12:11 ` [PATCH net 2/2] selftests: bridge_vlan_mcast: Test toggling of multicast snooping Ido Schimmel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260517121122.188333-1-idosch@nvidia.com \
--to=idosch@nvidia.com \
--cc=aroulin@nvidia.com \
--cc=bridge@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petrm@nvidia.com \
--cc=razor@blackwall.org \
--cc=tglx@kernel.org \
--cc=yongwang@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox