Re: [PATCH net] net: bridge: dynamically allocate frame_type instances for CFM and MRP

[Nikolay Aleksandrov <razor@blackwall.org>]

On 04/09/2026 03:44, Eric Dumazet wrote:
> struct br_frame_type contains an embedded struct hlist_node list, which
> is linked into a bridge's per-instance br->frame_type_list via
> br_add_frame(br, ft).
> 
> Both cfm_frame_type and mrp_frame_type were declared as static global
> variables. When multiple bridge devices enable CFM MEPs or MRP instances
> concurrently (e.g. across different network namespaces), they share
> the same static global br_frame_type node.
> 
> Calling br_add_frame() on a second bridge links the same hlist_node into
> the second bridge's frame_type_list, corrupting the first bridge's list.
> Later, when br_del_frame() deletes the node from one bridge and poisons
> its list pointers, a subsequent teardown on another bridge walks its
> frame_type_list and dereferences the poisoned pointer in hlist_del_rcu(),
> triggering a general protection fault.
> 
> Furthermore, sharing or embedding fixed br_frame_type instances leads to
> RCU node reuse violations: if MEPs or MRP instances are repeatedly added
> and deleted, hlist_del_rcu() unlinks the node without waiting for an RCU
> grace period, and a subsequent addition immediately re-inserts and modifies
> the node while concurrent lockless readers in br_handle_frame() /
> br_process_frame_type() may still be traversing it.
> 
> Fix this by dynamically allocating struct br_frame_type upon registration
> in br_add_frame() and freeing it with kfree_rcu() in br_del_frame(). Also
> ensure all registered frame types are cleaned up during bridge deletion via
> br_del_frame_all().
> 
> Fixes: 90c628dd47ff ("net: bridge: extend the process of special frames")
> Fixes: dc32cbb3dbd7 ("bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.")
> Reported-by: syzbot+1df7473ef265fe8ba6e1@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a9a137f.9266084e.bf0d7.02e3.GAE@google.com/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> --
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
>   net/bridge/br_cfm.c     | 17 +++++++++--------
>   net/bridge/br_if.c      |  2 ++
>   net/bridge/br_input.c   | 40 +++++++++++++++++++++++++++++++++++-----
>   net/bridge/br_mrp.c     | 16 +++++++---------
>   net/bridge/br_private.h |  8 ++++++--
>   5 files changed, 59 insertions(+), 24 deletions(-)
> 

Thanks Eric, but there is already a patch that should take care of this.
A week ago I pinged the previous reporter of these issues and he posted
an updated patch yesterday:
https://lore.kernel.org/netdev/0345b9d5aa60ba416f6738ff1b87140f0a749cb8.1788417901.git.zhilinz@nebusec.ai/

Cheers,
  Nik