[PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

Fragmented packets are dropped on a vlan filtering bridge with bridge
conntrack when the protocol of their vlan tag differs from the bridge's
vlan_protocol, an 802.1Q tag on an 802.1ad bridge for instance. Patch 1
handles the tag when refragmenting. Patch 2 adds a selftest.

As discussed with Pablo in the first posting
(https://lore.kernel.org/r/atck-NoWvemxIsF6@chamomile), the
DEBUG_NET_WARN_ON_ONCE() change went to nf on its own and is now in the net
tree as 683ff28ab18a. This series is based on that commit and is meant
for nf-next, which does not have it yet.

Changes since the first posting
(https://lore.kernel.org/r/20261020000308.37362-1-laveeshb@laveeshbansal.com):
patch 1 keeps the tag together with the ethernet header instead of in
separate fields, and the selftest runs its checks even if the kernel had
warned before.

I used an LLM tool for the analysis, the code and the test runs.

I tested the series on arm64 and x86_64, with and without KASAN, lockdep
and kmemleak. The selftest fails without patch 1.

Laveesh Bansal (2):
  netfilter: bridge: refragment packets with a vlan tag moved by the
    bridge
  selftests: netfilter: add bridge conntrack test for vlan protocol
    mismatch

 include/linux/netfilter_bridge.h              |   4 +-
 net/bridge/netfilter/nf_conntrack_bridge.c    |  46 +++-
 .../testing/selftests/net/netfilter/Makefile  |   1 +
 .../net/netfilter/bridge_ct_vlan_proto.sh     | 198 ++++++++++++++++++
 tools/testing/selftests/net/netfilter/config  |   1 +
 5 files changed, 241 insertions(+), 9 deletions(-)
 create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh


base-commit: 683ff28ab18accb25268741a724645eee839d41a
-- 
2.43.0

[PATCH nf-next 1/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

Fragmented IPv4 and IPv6 packets are dropped on a vlan filtering bridge
with bridge conntrack when the protocol of their vlan tag differs from the
vlan_protocol of the bridge, an 802.1Q tag on an 802.1ad bridge for
instance. Unfragmented traffic is not affected.

br_allowed_ingress() moves such a tag back into the packet after the
NF_BR_PRE_ROUTING hooks and sets skb->protocol to the vlan ethertype, but
bridge conntrack has already defragmented the packet by then. In
postrouting nf_ct_bridge_refrag() does not know that ethertype and drops
the packet. On CONFIG_DEBUG_NET kernels the drop also warns, which is what
syzbot reported.

Save the tag with the ethernet header, pull the tag off before fragmenting
and push it back onto each fragment in nf_ct_bridge_frag_restore(), as
br_netfilter does with its encapsulation header. A ruleset can rewrite the
tag, so check the IP version against its ethertype first.

Reported-by: syzbot+a8ba738fe2db6b4bb27f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
---
 include/linux/netfilter_bridge.h           |  4 +-
 net/bridge/netfilter/nf_conntrack_bridge.c | 46 ++++++++++++++++++----
 2 files changed, 41 insertions(+), 9 deletions(-)

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 743475ca7e9d..772f6da27237 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -3,10 +3,12 @@
 #define __LINUX_BRIDGE_NETFILTER_H
 
 #include <uapi/linux/netfilter_bridge.h>
+#include <linux/if_vlan.h>
 #include <linux/skbuff.h>
 
 struct nf_bridge_frag_data {
-	char    mac[ETH_HLEN];
+	char    mac[ETH_HLEN + VLAN_HLEN];
+	u8      encap_len;
 	bool    vlan_present;
 	u16     vlan_tci;
 	__be16  vlan_proto;
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 8c83dc05114b..be4a04e9c90e 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -326,8 +326,10 @@ static unsigned int nf_ct_bridge_in(void *priv, struct sk_buff *skb,
 }
 
 static void nf_ct_bridge_frag_save(struct sk_buff *skb,
-				   struct nf_bridge_frag_data *data)
+				   struct nf_bridge_frag_data *data,
+				   unsigned int encap_len)
 {
+	data->encap_len = encap_len;
 	if (skb_vlan_tag_present(skb)) {
 		data->vlan_present = true;
 		data->vlan_tci = skb->vlan_tci;
@@ -335,7 +337,8 @@ static void nf_ct_bridge_frag_save(struct sk_buff *skb,
 	} else {
 		data->vlan_present = false;
 	}
-	skb_copy_from_linear_data_offset(skb, -ETH_HLEN, data->mac, ETH_HLEN);
+	skb_copy_from_linear_data_offset(skb, -ETH_HLEN, data->mac,
+					 ETH_HLEN + encap_len);
 }
 
 static unsigned int
@@ -345,12 +348,38 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state,
 				  struct sk_buff *))
 {
 	struct nf_bridge_frag_data data;
+	__be16 proto = skb->protocol;
+	unsigned int encap_len = 0;
 
 	if (!BR_INPUT_SKB_CB(skb)->frag_max_size)
 		return NF_ACCEPT;
 
-	nf_ct_bridge_frag_save(skb, &data);
-	switch (skb->protocol) {
+	/* A vlan filtering bridge moves a vlan tag into the packet if its
+	 * protocol differs from the bridge vlan_protocol, after prerouting
+	 * defragmented the packet. Look past that tag.
+	 */
+	if (eth_type_vlan(proto)) {
+		const struct vlan_hdr *vhdr;
+
+		if (skb_network_offset(skb) != VLAN_HLEN) {
+			DEBUG_NET_WARN_ON_ONCE(1);
+			return NF_DROP;
+		}
+
+		vhdr = (const struct vlan_hdr *)skb->data;
+		encap_len = VLAN_HLEN;
+		proto = vhdr->h_vlan_encapsulated_proto;
+
+		/* A ruleset can rewrite the tag, make sure it still matches */
+		if ((proto == htons(ETH_P_IP) && ip_hdr(skb)->version != 4) ||
+		    (proto == htons(ETH_P_IPV6) && ipv6_hdr(skb)->version != 6))
+			return NF_DROP;
+	}
+
+	nf_ct_bridge_frag_save(skb, &data, encap_len);
+	__skb_pull(skb, encap_len);
+
+	switch (proto) {
 	case htons(ETH_P_IP):
 		nf_br_ip_fragment(state->net, state->sk, skb, &data, output);
 		break;
@@ -358,20 +387,19 @@ nf_ct_bridge_refrag(struct sk_buff *skb, const struct nf_hook_state *state,
 		nf_br_ip6_fragment(state->net, state->sk, skb, &data, output);
 		break;
 	default:
-		DEBUG_NET_WARN_ON_ONCE(1);
+		DEBUG_NET_WARN_ON_ONCE(!encap_len);
 		return NF_DROP;
 	}
 
 	return NF_STOLEN;
 }
 
-/* Actually only slow path refragmentation needs this. */
 static int nf_ct_bridge_frag_restore(struct sk_buff *skb,
 				     const struct nf_bridge_frag_data *data)
 {
 	int err;
 
-	err = skb_cow_head(skb, ETH_HLEN);
+	err = skb_cow_head(skb, ETH_HLEN + data->encap_len);
 	if (err) {
 		kfree_skb(skb);
 		return -ENOMEM;
@@ -381,7 +409,9 @@ static int nf_ct_bridge_frag_restore(struct sk_buff *skb,
 	else if (skb_vlan_tag_present(skb))
 		__vlan_hwaccel_clear_tag(skb);
 
-	skb_copy_to_linear_data_offset(skb, -ETH_HLEN, data->mac, ETH_HLEN);
+	__skb_push(skb, data->encap_len);
+	skb_copy_to_linear_data_offset(skb, -ETH_HLEN, data->mac,
+				       ETH_HLEN + data->encap_len);
 	skb_reset_mac_header(skb);
 
 	return 0;
-- 
2.43.0

[PATCH nf-next 2/2] selftests: netfilter: add bridge conntrack test for vlan protocol mismatch

[Laveesh Bansal]

Test that a vlan filtering bridge with bridge conntrack forwards
fragmented packets whose vlan tag protocol differs from the vlan_protocol
of the bridge.

Send fragmented IPv4 and IPv6 pings through the bridge with matching and
different bridge and vlan protocols, including a promisc bridge and a
tagged egress port, and check that they arrive, that conntrack reassembled
them and that the kernel did not warn. The last check needs
CONFIG_DEBUG_NET.

Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
---
 .../testing/selftests/net/netfilter/Makefile  |   1 +
 .../net/netfilter/bridge_ct_vlan_proto.sh     | 198 ++++++++++++++++++
 tools/testing/selftests/net/netfilter/config  |   1 +
 3 files changed, 200 insertions(+)
 create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh

diff --git a/tools/testing/selftests/net/netfilter/Makefile b/tools/testing/selftests/net/netfilter/Makefile
index df3c20c90f5d..1904f5b80679 100644
--- a/tools/testing/selftests/net/netfilter/Makefile
+++ b/tools/testing/selftests/net/netfilter/Makefile
@@ -12,6 +12,7 @@ TEST_PROGS := \
 	br_netfilter.sh \
 	br_netfilter_queue.sh \
 	bridge_brouter.sh \
+	bridge_ct_vlan_proto.sh \
 	conntrack_clash.sh \
 	conntrack_dump_flush.sh \
 	conntrack_icmp_related.sh \
diff --git a/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh b/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
new file mode 100755
index 000000000000..28e7759655c4
--- /dev/null
+++ b/tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
@@ -0,0 +1,198 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Fragmented packets in vlans forwarded by a vlan filtering bridge with
+# bridge conntrack. If the protocol of the vlan tag differs from the
+# vlan_protocol of the bridge, the bridge moves the tag into the packet after
+# prerouting, and conntrack has to fragment the reassembled packets again
+# with the tag in front of the ip header.
+#
+# Send fragmented pings through the bridge and check that they arrive, that
+# conntrack reassembled them and that the kernel did not warn.
+#
+#                       ns0 (br0)
+#   ns1 eth0.100 -- veth0 ------- veth1 -- eth1.100 ns2
+
+source lib.sh
+
+# TAINT_WARN, bridge conntrack only warns about the vlan tag on kernels built
+# with CONFIG_DEBUG_NET
+taint_warn=512
+
+checktool "nft --version" "run test without nft tool"
+checktool "bridge -V" "run test without bridge tool"
+
+read -r tainted < /proc/sys/kernel/tainted
+
+trap cleanup_all_ns EXIT
+
+ret=0
+skipped=0
+
+# $1: vlan_protocol of the bridge, $2: protocol of the vlan devices,
+# $3: "tagged" to send the frames out of the bridge tagged with vlan 1
+setup()
+{
+	local br_proto="$1"
+	local vlan_proto="$2"
+	local rx=eth1
+
+	setup_ns ns0 ns1 ns2
+
+	ip -net "$ns0" link add br0 type bridge vlan_filtering 1 \
+		vlan_protocol "$br_proto" || return "$ksft_skip"
+	ip -net "$ns0" link add veth0 type veth peer name eth0 netns "$ns1" || return "$ksft_skip"
+	ip -net "$ns0" link add veth1 type veth peer name eth1 netns "$ns2" || return "$ksft_skip"
+
+	for i in 0 1; do
+		ip -net "$ns0" link set "veth$i" master br0
+		ip -net "$ns0" link set "veth$i" up
+		# If the protocols match, vlan 100 has to be allowed. If not,
+		# the bridge treats the tag as part of the packet and the
+		# frames use the default pvid 1.
+		if [ "$br_proto" = "$vlan_proto" ]; then
+			ip netns exec "$ns0" bridge vlan add dev "veth$i" vid 100 ||
+				return "$ksft_skip"
+		fi
+	done
+	ip -net "$ns0" link set br0 up
+
+	ip -net "$ns1" link set eth0 up
+	ip -net "$ns2" link set eth1 up
+
+	if [ "$3" = "tagged" ]; then
+		# The bridge adds a tag with its own protocol on egress, in
+		# front of the vlan 100 tag that is part of the packet.
+		ip netns exec "$ns0" bridge vlan add dev veth1 vid 1 pvid ||
+			return "$ksft_skip"
+		ip -net "$ns2" link add link eth1 name eth1.1 type vlan \
+			protocol "$br_proto" id 1 || return "$ksft_skip"
+		ip -net "$ns2" link set eth1.1 up
+		rx=eth1.1
+	fi
+
+	ip -net "$ns1" link add link eth0 name eth0.100 type vlan \
+		protocol "$vlan_proto" id 100 || return "$ksft_skip"
+	ip -net "$ns2" link add link "$rx" name eth1.100 type vlan \
+		protocol "$vlan_proto" id 100 || return "$ksft_skip"
+
+	ip -net "$ns1" link set eth0.100 mtu 1400 up
+	ip -net "$ns2" link set eth1.100 mtu 1400 up
+
+	ip -net "$ns1" addr add 10.0.100.1/24 dev eth0.100
+	ip -net "$ns2" addr add 10.0.100.2/24 dev eth1.100
+	ip -net "$ns1" addr add dead:100::1/64 dev eth0.100 nodad
+	ip -net "$ns2" addr add dead:100::2/64 dev eth1.100 nodad
+
+	# Loading a ct rule in the bridge family enables bridge conntrack. The
+	# postrouting counters see the packets reassembled by conntrack. Without
+	# reassembly no packet is bigger than the 1400 byte mtu plus the 4 byte
+	# vlan tag. @nh,0,4 is the ip version, which works with a vlan tag
+	# inside the packet.
+	ip netns exec "$ns0" nft -f - <<EOF || return "$ksft_skip"
+table bridge t {
+	counter reasm4 { }
+	counter reasm6 { }
+	chain pre {
+		type filter hook prerouting priority 0; policy accept;
+		ct state new counter
+	}
+	chain post {
+		type filter hook postrouting priority 0; policy accept;
+		@nh,0,4 4 meta length > 1500 counter name "reasm4"
+		@nh,0,4 6 meta length > 1500 counter name "reasm6"
+	}
+}
+EOF
+
+	return 0
+}
+
+# $1: vlan_protocol of the bridge, $2: protocol of the vlan devices,
+# $3: "clone" to make the bridge forward clones, which makes fragmenting take
+#     the slow path, or "tagged", see setup()
+run_case()
+{
+	local desc="$2 vlan on $1 bridge${3:+, $3}"
+	local rc=0
+	local cnt dst
+
+	setup "$1" "$2" "$3"
+	rc=$?
+	if [ "$rc" -ne 0 ]; then
+		echo "SKIP: could not set up $desc"
+		return "$rc"
+	fi
+
+	if [ "$3" = "clone" ]; then
+		# The bridge delivers a clone of the packets it forwards if it
+		# also receives them.
+		ip -net "$ns0" link set br0 promisc on
+	fi
+
+	# Wait until the bridge forwards the plain vlan traffic.
+	if ! busywait 5000 ip netns exec "$ns1" ping -c 1 -W 1 -q 10.0.100.2 >/dev/null 2>&1; then
+		echo "FAIL: no connectivity through the bridge, $desc"
+		cleanup_all_ns
+		return 1
+	fi
+
+	# 3000 bytes of icmp payload do not fit the 1400 byte mtu, the sender
+	# fragments the packets and bridge conntrack reassembles and fragments
+	# them again.
+	for dst in 10.0.100.2 dead:100::2; do
+		cnt=reasm4
+		[ "$dst" = "dead:100::2" ] && cnt=reasm6
+
+		if ip netns exec "$ns1" ping -c 3 -i 0.2 -W 2 -s 3000 -q "$dst" >/dev/null; then
+			echo "PASS: fragmented ping to $dst, $desc"
+		else
+			echo "FAIL: fragmented ping to $dst, $desc"
+			rc=1
+		fi
+
+		if ! ip netns exec "$ns0" nft list counter bridge t "$cnt" |
+		     grep -q "packets [1-9]"; then
+			echo "FAIL: conntrack did not reassemble the packets to $dst, $desc"
+			rc=1
+		fi
+	done
+
+	cleanup_all_ns
+
+	return $rc
+}
+
+# $@: arguments for run_case
+try_case()
+{
+	run_case "$@"
+	case $? in
+	0) ;;
+	"$ksft_skip") skipped=1 ;;
+	*) ret=1 ;;
+	esac
+}
+
+# bridge protocol, protocol of the vlan devices
+try_case 802.1q 802.1q
+try_case 802.1ad 802.1q
+try_case 802.1q 802.1ad
+try_case 802.1ad 802.1q clone
+try_case 802.1ad 802.1q tagged
+
+if [ $((tainted & taint_warn)) -ne 0 ]; then
+	echo "SKIP: kernel had already warned, not checking for a warning"
+else
+	read -r tainted < /proc/sys/kernel/tainted
+	if [ $((tainted & taint_warn)) -ne 0 ]; then
+		echo "FAIL: kernel warned"
+		ret=1
+	fi
+fi
+
+if [ "$skipped" -eq 1 ] && [ "$ret" -eq 0 ]; then
+	exit "$ksft_skip"
+fi
+
+exit $ret
diff --git a/tools/testing/selftests/net/netfilter/config b/tools/testing/selftests/net/netfilter/config
index 629b2b29ed1a..91985320c292 100644
--- a/tools/testing/selftests/net/netfilter/config
+++ b/tools/testing/selftests/net/netfilter/config
@@ -62,6 +62,7 @@ CONFIG_NET_SCH_HTB=m
 CONFIG_NET_SCH_NETEM=m
 CONFIG_NET_VRF=y
 CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
 CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_MARK=y
-- 
2.43.0

Re: [PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Pablo Neira Ayuso]

Hi,

On Mon, Nov 09, 2026 at 11:18:40AM -0800, Laveesh Bansal wrote:
> Fragmented packets are dropped on a vlan filtering bridge with bridge
> conntrack when the protocol of their vlan tag differs from the bridge's
> vlan_protocol, an 802.1Q tag on an 802.1ad bridge for instance. Patch 1
> handles the tag when refragmenting. Patch 2 adds a selftest.
> 
> As discussed with Pablo in the first posting
> (https://lore.kernel.org/r/atck-NoWvemxIsF6@chamomile), the
> DEBUG_NET_WARN_ON_ONCE() change went to nf on its own and is now in the net
> tree as 683ff28ab18a. This series is based on that commit and is meant
> for nf-next, which does not have it yet.
> 
> Changes since the first posting
> (https://lore.kernel.org/r/20261020000308.37362-1-laveeshb@laveeshbansal.com):
> patch 1 keeps the tag together with the ethernet header instead of in
> separate fields, and the selftest runs its checks even if the kernel had
> warned before.
> 
> I used an LLM tool for the analysis, the code and the test runs.

Do you have a usecase for this?

> I tested the series on arm64 and x86_64, with and without KASAN, lockdep
> and kmemleak. The selftest fails without patch 1.
> 
> Laveesh Bansal (2):
>   netfilter: bridge: refragment packets with a vlan tag moved by the
>     bridge
>   selftests: netfilter: add bridge conntrack test for vlan protocol
>     mismatch
> 
>  include/linux/netfilter_bridge.h              |   4 +-
>  net/bridge/netfilter/nf_conntrack_bridge.c    |  46 +++-
>  .../testing/selftests/net/netfilter/Makefile  |   1 +
>  .../net/netfilter/bridge_ct_vlan_proto.sh     | 198 ++++++++++++++++++
>  tools/testing/selftests/net/netfilter/config  |   1 +
>  5 files changed, 241 insertions(+), 9 deletions(-)
>  create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh
> 
> 
> base-commit: 683ff28ab18accb25268741a724645eee839d41a
> -- 
> 2.43.0
> 

Re: [PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

On Tue, Nov 10, 2026 at 01:44:10AM +0100, Pablo Neira Ayuso wrote:
> Do you have a usecase for this?

I found this through the syzbot report and haven't seen a user report of
it. This is the follow-up for nf-next we discussed in
https://lore.kernel.org/r/atck-NoWvemxIsF6@chamomile.

Re: [PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Pablo Neira Ayuso]

On Mon, Nov 09, 2026 at 05:04:50PM -0800, Laveesh Bansal wrote:
> On Tue, Nov 10, 2026 at 01:44:10AM +0100, Pablo Neira Ayuso wrote:
> > Do you have a usecase for this?
> 
> I found this through the syzbot report and haven't seen a user report of
> it.

Yes, there is a patch to fix replace the WARN_ON_ONCE() that could be
found. But does it make sense what syzbot is trying in real life?

> This is the follow-up for nf-next we discussed in
> https://lore.kernel.org/r/atck-NoWvemxIsF6@chamomile.

Yes, I remember, thanks for the link.

Re: [PATCH nf-next 0/2] netfilter: bridge: refragment packets with a vlan tag moved by the bridge

[Laveesh Bansal]

On Tue, Nov 10, 2026 at 02:08:26AM +0100, Pablo Neira Ayuso wrote:
> But does it make sense what syzbot is trying in real life?

Here is a sample scenario: a customer sends large fragmented UDP packets
into a bridge doing QinQ with stateful bridge rules. It takes that
combination so it is rare.