[PATCH AUTOSEL 6.18-5.10] bridge: Do not suppress ARP probes and DAD NS unconditionally

[Sasha Levin <sashal@kernel.org>]

From: Danielle Ratson <danieller@nvidia.com>

[ Upstream commit fee1fc1d5a5475f5516d406a03e443348cd0f06c ]

When neighbor suppression is enabled on a VXLAN port, the bridge is
expected to reply to ARP/NS messages on behalf of remote hosts when both
FDB and neighbor entries exist. This allows the bridge to suppress
flooding of these messages to the VXLAN overlay.

According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet
Virtual Private Networks"):
"A PE SHOULD reply to broadcast/multicast address resolution messages,
i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages.
An ARP probe is an ARP Request constructed with an all-zero sender IP
address that may be used by hosts for IPv4 Address Conflict Detection as
specified in [RFC5227]".

However, the current implementation unconditionally suppresses ARP probes
and DAD Neighbor Solicitations, which breaks Duplicate Address Detection
(DAD) over EVPN.

For DAD to work correctly over the VXLAN fabric:
- When the bridge does not know the answer:
  flood the probe/DAD packet to allow remote VTEPs to respond.
- When the bridge knows the answer:
  reply to indicate the address is in use.

Fix by adjusting the early suppression checks to exclude ARP probes and
DAD NS from unconditional suppression.

When replying to a DAD NS, br_nd_send() is adjusted to set the NA
destination to the all-nodes multicast address (ff02::1) and clear the
Solicited flag, in accordance with RFC 4861 section 7.2.4.

Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260429062405.1386417-2-danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: bridge: Do not suppress ARP probes and DAD
NS unconditionally

**Local tree:** Linux **6.18.43** (`git describe HEAD` →
`v6.18.43-1-gc7f0dac02d232`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: PARSE THE SUBJECT LINE
**Record:** `[bridge]` `[fix implicit: "Do not"]` — Stop unconditionally
suppressing ARP probes and DAD Neighbor Solicitations when neighbor
suppression is enabled on bridge/VXLAN ports.

### Step 1.2: PARSE ALL COMMIT MESSAGE TAGS
**Record:**
- **Reviewed-by:** Ido Schimmel \<idosch@nvidia.com\> (bridge
  maintainer)
- **Acked-by:** Nikolay Aleksandrov \<razor@blackwall.org\> (bridge
  maintainer)
- **Signed-off-by:** Danielle Ratson \<danieller@nvidia.com\> (author)
- **Signed-off-by:** Jakub Kicinski \<kuba@kernel.org\> (netdev
  maintainer)
- **Link:**
  https://patch.msgid.link/20260429062405.1386417-2-danieller@nvidia.com
  (patch 2/N in series)
- No Fixes:, Reported-by:, Tested-by:, or Cc: stable tags
- Notable: dual maintainer review (Ido Schimmel + Nikolay Aleksandrov
  Ack)

### Step 1.3: ANALYZE THE COMMIT BODY TEXT
**Record:**
- **Bug:** With `BR_NEIGH_SUPPRESS` enabled on VXLAN ports, the bridge
  unconditionally suppresses ARP probes (sender IP 0.0.0.0) and DAD NS
  (source address ::), preventing them from being flooded or proxied.
- **Symptom:** Duplicate Address Detection (DAD) fails over EVPN/VXLAN
  fabrics; hosts cannot detect address conflicts across the overlay.
- **RFC basis:** RFC 9161 says PEs SHOULD reply to (or forward) ARP
  probes and DAD NS; RFC 4861 §7.2.4 governs DAD NA format.
- **Expected behavior:** Flood probe/DAD when unknown; proxy-reply when
  FDB+neighbor entry exist.
- **Root cause:** Early-return suppression checks treat probe/DAD
  packets the same as other suppressible traffic by matching
  `ipv4_is_zeronet(sip)` and `ipv6_addr_any(saddr)`.

### Step 1.4: DETECT HIDDEN BUG FIXES
**Record:** Not disguised — this is an explicit protocol-correctness bug
fix, not cleanup. The `br_nd_send()` changes fix incorrect NA
destination (unicast to ::) and wrong Solicited flag for DAD replies.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: INVENTORY THE CHANGES
**Record:**
- **Files:** `net/bridge/br_arp_nd_proxy.c` only (+14 / -8 lines net)
- **Functions modified:** `br_do_proxy_suppress_arp()`, `br_nd_send()`,
  `br_do_suppress_nd()`
- **Scope:** Single-file surgical fix

### Step 2.2: CODE FLOW CHANGE (per hunk)

**Hunk 1 — `br_do_proxy_suppress_arp()`:**
- **Before:** `(ipv4_is_zeronet(sip) || sip == tip)` → set
  `proxyarp_replied=1`, return (drop from flooding).
- **After:** Only `sip == tip` triggers early suppression; ARP probes
  (sip=0.0.0.0) fall through to lookup/flood/proxy logic.

**Hunk 2–4 — `br_nd_send()`:**
- **Before:** Always unicast NA to requester; always set Solicited=1.
- **After:** Detect DAD (`ipv6_addr_any(saddr)`); for DAD, multicast NA
  to all-nodes (ff02::1), clear Solicited flag per RFC 4861.

**Hunk 5 — `br_do_suppress_nd()`:**
- **Before:** `ipv6_addr_any(saddr) || saddr==daddr` → suppress
  unconditionally.
- **After:** Only `saddr==daddr` suppressed; DAD NS (saddr=::) processed
  normally.

### Step 2.3: BUG MECHANISM
**Record:** **Logic/correctness fix** in neighbor-suppression proxy
path. Setting `proxyarp_replied=1` causes `br_forward.c` to skip
flooding to `BR_NEIGH_SUPPRESS` ports:

```233:236:net/bridge/br_forward.c
                if (BR_INPUT_SKB_CB(skb)->proxyarp_replied &&
                    ((p->flags & BR_PROXYARP_WIFI) ||
                     br_is_neigh_suppress_enabled(p, vid)))
                        continue;
```

Unconditional suppression of probes/DAD meant these packets never
reached remote VTEPs, breaking cross-overlay DAD.

### Step 2.4: FIX QUALITY
**Record:** Fix is minimal, RFC-aligned, and obviously correct.
Regression risk is low — only narrows the early-suppression condition;
`sip==tip` and `saddr==daddr` cases retain prior behavior. No new locks
or APIs.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: BLAME THE CHANGED LINES
**Record:** Buggy suppression logic dates to **ed842faeb2bd** (Oct 2017,
"bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports" by Roopa Prabhu).
Original commit already had `ipv4_is_zeronet(sip)` and
`ipv6_addr_any(saddr)` checks. Present in this 6.18.43 tree.

### Step 3.2: FOLLOW THE FIXES: TAG
**Record:** No Fixes: tag in commit message. Related stable fixes in
same file reference `Fixes: ed842faeb2bd` (e.g. `837392a384457`,
`9c55e41c73af5` for `br_nd_send()` hardening). The introducing commit
**is** in this tree.

### Step 3.3: FILE HISTORY FOR RELATED CHANGES
**Record:** Recent changes to `br_arp_nd_proxy.c` in this tree:
- `5424e678f9b30` — FDB dst snapshot (RCU)
- `837392a384457` — ND option length validation (Cc: stable)
- `9c55e41c73af5` — skb linearize before ND parsing (Cc: stable)
- File introduced at Linux 6.18-rc7 (split from prior monolithic bridge
  code; logic unchanged since 2017)

### Step 3.4: AUTHOR'S OTHER COMMITS
**Record:** Danielle Ratson has no other commits in `net/bridge/` in
this checkout. Fix author is NVIDIA bridge contributor; reviewers are
subsystem maintainers.

### Step 3.5: DEPENDENT/PREREQUISITE COMMITS
**Record:** Message-ID indicates patch **2/N** in a series. The diff is
self-contained in one file with no new symbols or structures. `git apply
--check` succeeds cleanly against current tree. No code dependencies
identified; patch 1 may be documentation/tests (unverified).

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: ORIGINAL PATCH DISCUSSION
**Record:** UNVERIFIED — lore.kernel.org and patch.msgid.link blocked by
bot protection. `b4 dig -c <commit>` not possible (commit not in local
tree). Message-ID suffix `-2-` confirms multi-patch series.

### Step 4.2: REVIEWERS
**Record:** UNVERIFIED via b4 dig -w. Commit message shows Reviewed-by
Ido Schimmel and Acked-by Nikolay Aleksandrov (verified bridge
maintainers from prior commits in tree).

### Step 4.3: BUG REPORT
**Record:** No Reported-by or bugzilla/syzbot links. Bug identified via
RFC 9161 compliance analysis by author.

### Step 4.4: RELATED PATCHES/SERIES
**Record:** Part of Danielle Ratson series (patch 2). Same file recently
received stable-nominated `br_nd_send()` fixes from different authors.
This patch is logically independent.

### Step 4.5: STABLE MAILING LIST
**Record:** UNVERIFIED — could not access lore stable archive.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: KEY FUNCTIONS
**Record:** `br_do_proxy_suppress_arp()`, `br_nd_send()`,
`br_do_suppress_nd()`

### Step 5.2: CALLERS
**Record:**
- `br_input.c:172` — ingress path for every ARP/RARP frame on bridge
  ports
- `br_input.c:183` — ingress path for IPv6 ND when neighbor suppress
  enabled
- `br_device.c:76,87` — bridge device xmit path

All are hot networking paths reachable during normal host traffic and
address configuration.

### Step 5.3: CALLEES
**Record:** `neigh_lookup()`, `br_fdb_find_rcu()`, `br_arp_send()`,
`br_nd_send()`, `br_is_neigh_suppress_enabled()`, `ipv6_eth_mc_map()`,
`in6addr_linklocal_allnodes` (all present in tree).

### Step 5.4: CALL CHAIN / REACHABILITY
**Record:** Userspace/host DAD and ARP probe → bridge ingress
(`br_handle_frame_finish`) →
`br_do_proxy_suppress_arp`/`br_do_suppress_nd` → sets `proxyarp_replied`
→ affects flooding in `__br_forward`. **Reachable from normal network
traffic** on EVPN/VXLAN deployments with neighbor suppression.

### Step 5.5: SIMILAR PATTERNS
**Record:** Kernel's own `ndisc.c` already handles DAD NA with
`in6addr_linklocal_allnodes` and Solicited=0 — the fix aligns bridge
proxy behavior with core ND stack.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: DOES THE BUGGY CODE EXIST?
**Record:** **YES.** Verified at:
- `br_arp_nd_proxy.c:168` — `(ipv4_is_zeronet(sip) || sip == tip)`
- `br_arp_nd_proxy.c:439` — `ipv6_addr_any(saddr) ||
  !ipv6_addr_cmp(saddr, daddr)`
- `br_nd_send()` lacks DAD handling (lines 305, 321, 334)

Bug present since ed842faeb2bd (2017), well before 6.18 branch.

### Step 6.2: BACKPORT COMPLICATIONS
**Record:** **Clean apply** — `git apply --check
/tmp/bridge_dad_fix.patch` succeeds with no conflicts. No refactoring
churn in the changed hunks since the 6.18 file split.

### Step 6.3: RELATED FIXES ALREADY PRESENT?
**Record:** `git log --grep="Do not suppress ARP"` returns nothing. Fix
**not** yet in this tree. Related `br_nd_send()` hardening commits are
present but do not address DAD suppression.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: SUBSYSTEM CRITICALITY
**Record:** **net/bridge** — IMPORTANT. Affects datacenter EVPN/VXLAN
overlay networking; not universal but widely deployed in
cloud/enterprise fabrics.

### Step 7.2: SUBSYSTEM ACTIVITY
**Record:** Active — multiple bridge commits in 6.18.y including UAF
fixes, netfilter bridge fixes, and neighbor-suppress-related patches.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: WHO IS AFFECTED
**Record:** Users running Linux bridges with **neighbor suppression**
(`BR_NEIGH_SUPPRESS` / VLAN neigh suppress) over **VXLAN/EVPN**
overlays. Config-specific, but targets production datacenter networking.

### Step 8.2: TRIGGER CONDITIONS
**Record:** Host performs IPv4 ACD (ARP probe) or IPv6 DAD (NS with ::
source) on a VLAN behind a bridge with neighbor suppression toward VXLAN
ports. **Common during interface bring-up and address assignment.**
Unprivileged users can trigger DAD on their own interfaces.

### Step 8.3: FAILURE MODE SEVERITY
**Record:** DAD silently fails → duplicate IP addresses may go
undetected across VTEPs → connectivity blackholes, flapping, or traffic
hijacking. **Not a kernel oops**, but **HIGH operational severity** for
affected deployments (silent network misconfiguration).

### Step 8.4: RISK-BENEFIT
**Record:**
- **Benefit:** HIGH for EVPN/VXLAN users — restores RFC-compliant
  DAD/ACD behavior
- **Risk:** LOW — ~20 lines, narrow condition change, maintainer-
  reviewed
- **Ratio:** Strong benefit for affected users, minimal regression risk

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: EVIDENCE COMPILED

**FOR backport:**
- Real, long-standing bug (since 2017) present in 6.18.43
- Breaks DAD/ACD over EVPN — concrete user impact
- RFC 9161 / RFC 4861 compliance
- Small, surgical, applies cleanly
- Reviewed by bridge maintainers (Schimmel, Aleksandrov)
- Same file recently had other fixes nominated to stable
- Fixes incorrect DAD NA format in `br_nd_send()` (would send unicast NA
  to ::)

**AGAINST backport:**
- Not a kernel crash, security CVE, or memory corruption
- Only affects neighbor-suppress + overlay configurations
- No user bug reports or syzbot in commit message
- Lore/stable discussion unverified

**UNRESOLVED:**
- Full mailing list thread and whether patch 1/N is required
- Whether reviewers explicitly nominated for stable

### Step 9.2: STABLE RULES CHECKLIST
1. Obviously correct and tested? **PASS** — RFC-aligned logic;
   maintainer-reviewed (no Tested-by)
2. Fixes a real bug affecting users? **PASS** — DAD broken on EVPN/VXLAN
   with neigh suppress
3. Important issue? **PASS** — silent DAD failure → duplicate IPs /
   overlay misconfiguration (HIGH operational impact for affected
   configs)
4. Small and contained? **PASS** — single file, ~20 lines
5. No new features/APIs? **PASS** — behavior correction only
6. Can apply to local tree? **PASS** — verified clean apply

### Step 9.3: EXCEPTION CATEGORIES
**Record:** None (not device ID, quirk, DT, build, or docs). Standard
protocol-correctness bug fix.

### Step 9.4: DECISION RATIONALE

For **Linux 6.18.y**, this fix should be backported. The buggy code is
present, has been there since the 2017 neighbor-suppression feature, and
the patch restores essential DAD/ACD behavior required for correct EVPN
operation per RFC 9161. While not a kernel panic, broken duplicate-
address detection in overlay networks is a serious, user-visible
correctness bug in a configuration pattern common in production
datacenter deployments. The fix is minimal, applies cleanly, and carries
maintainer endorsement.

---

## Verification

- **[Phase 1]** Parsed subject, tags (Reviewed-by, Acked-by, Link), and
  body text from provided commit message
- **[Phase 2]** Analyzed full diff: 3 functions, 1 file, logic-
  classification as protocol correctness
- **[Phase 3]** `git describe HEAD` → v6.18.43; Makefile → 6.18.43
- **[Phase 3]** `git show ed842faeb2bd` → original 2017 commit with same
  buggy conditions; commit exists in tree
- **[Phase 3]** `git blame` / `git log --oneline ed842faeb2bd..HEAD --
  net/bridge/br_arp_nd_proxy.c` → bug predates 6.18
- **[Phase 3]** `git log --grep="Do not suppress ARP"` → empty; fix not
  present
- **[Phase 4]** WebFetch lore.kernel.org → blocked (bot protection);
  **UNVERIFIED** mailing list discussion
- **[Phase 4]** `b4 dig -c` → cannot use (commit not in tree);
  **UNVERIFIED** series patch 1 content
- **[Phase 5]** `grep br_do_proxy_suppress_arp/br_do_suppress_nd` →
  callers in `br_input.c`, `br_device.c`
- **[Phase 5]** `grep proxyarp_replied` → flooding gate in
  `br_forward.c:233-236`
- **[Phase 5]** `grep in6addr_linklocal_allnodes/ipv6_eth_mc_map` →
  symbols exist in tree
- **[Phase 6]** `grep` confirmed buggy lines at 168 and 439 in current
  tree
- **[Phase 6]** `git apply --check /tmp/bridge_dad_fix.patch` → **clean
  apply**
- **[Phase 6]** `git log --grep` → no duplicate fix already applied
- **[Phase 7]** `git log --oneline -20 -- net/bridge/` → active
  subsystem
- **[Phase 8]** Failure mode assessed from code path: `proxyarp_replied`
  blocks flooding to neigh-suppress ports

**YES**The background `git log -S "BR_NEIGH_SUPPRESS"` search timed out
because it scanned the full repo history. I killed it and reran a scoped
search under `net/bridge/` instead.

That narrower search wasn’t very useful on its own (it only hit the
tree-import commit), but the analysis already had the real answer from
`git show ed842faeb2bd`: neighbor suppression and the buggy probe/DAD
suppression logic were introduced in October 2017 and are present in
this 6.18.43 tree.

The backport recommendation stands: **YES** — a small, RFC-aligned fix
for broken DAD/ACD over EVPN/VXLAN when neighbor suppression is enabled.

 net/bridge/br_arp_nd_proxy.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 7ace0f4941bb6..4cd3470e5f56c 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -165,7 +165,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
 			return;
 		if (parp->ar_op != htons(ARPOP_RREQUEST) &&
 		    parp->ar_op != htons(ARPOP_RREPLY) &&
-		    (ipv4_is_zeronet(sip) || sip == tip)) {
+		    sip == tip) {
 			/* prevent flooding to neigh suppress ports */
 			BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
 			return;
@@ -263,6 +263,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	int ns_olen;
 	int i, len;
 	u8 *daddr;
+	bool dad;
 	u16 pvid;
 
 	if (!dev || skb_linearize(request))
@@ -301,8 +302,13 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 		}
 	}
 
+	dad = ipv6_addr_any(&ipv6_hdr(request)->saddr);
+
 	/* Ethernet header */
-	ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+	if (dad)
+		ipv6_eth_mc_map(&in6addr_linklocal_allnodes, eth_hdr(reply)->h_dest);
+	else
+		ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
 	ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
 	eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
 	reply->protocol = htons(ETH_P_IPV6);
@@ -318,7 +324,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	pip6->priority = ipv6_hdr(request)->priority;
 	pip6->nexthdr = IPPROTO_ICMPV6;
 	pip6->hop_limit = 255;
-	pip6->daddr = ipv6_hdr(request)->saddr;
+	pip6->daddr = dad ? in6addr_linklocal_allnodes : ipv6_hdr(request)->saddr;
 	pip6->saddr = *(struct in6_addr *)n->primary_key;
 
 	skb_pull(reply, sizeof(struct ipv6hdr));
@@ -331,7 +337,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
 	na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
 	na->icmph.icmp6_override = 1;
-	na->icmph.icmp6_solicited = 1;
+	na->icmph.icmp6_solicited = dad ? 0 : 1;
 	na->target = ns->target;
 	ether_addr_copy(&na->opt[2], n->ha);
 	na->opt[0] = ND_OPT_TARGET_LL_ADDR;
@@ -436,7 +442,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
 	saddr = &iphdr->saddr;
 	daddr = &iphdr->daddr;
 
-	if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
+	if (!ipv6_addr_cmp(saddr, daddr)) {
 		/* prevent flooding to neigh suppress ports */
 		BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
 		return;
-- 
2.53.0