From: Ido Schimmel <idosch@nvidia•com>
To: Zijing Yin <yzjaurora@gmail•com>
Cc: netdev@vger•kernel.org, bridge@lists•linux.dev,
razor@blackwall•org, davem@davemloft•net, edumazet@google•com,
kuba@kernel•org, pabeni@redhat•com, horms@kernel•org,
nathan@kernel•org, nick.desaulniers+lkml@gmail•com,
morbo@google•com, justinstitt@google•com, petrm@nvidia•com,
linux-kernel@vger•kernel.org, llvm@lists•linux.dev
Subject: Re: [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group
Date: Fri, 3 Apr 2026 12:56:29 +0300 [thread overview]
Message-ID: <20260403095629.GA65129@shredder> (raw)
In-Reply-To: <20260402140153.3925663-1-yzjaurora@gmail.com>
On Thu, Apr 02, 2026 at 07:01:53AM -0700, Zijing Yin wrote:
> When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and
> nbp_vlan_group() return NULL (br_private.h stub definitions). The
> BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and
> reaches br_fdb_delete_locals_per_vlan_port() and
> br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer
> is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).
>
> The observed crash is in the delete path, triggered when creating a
> bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0
> via RTM_NEWLINK. The insert helper has the same bug pattern.
>
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI
> KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
> RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310
> Call Trace:
> br_fdb_toggle_local_vlan_0+0x452/0x4c0
> br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276
> br_boolopt_toggle net/bridge/br.c:313
> br_boolopt_multi_toggle net/bridge/br.c:364
> br_changelink net/bridge/br_netlink.c:1542
> br_dev_newlink net/bridge/br_netlink.c:1575
>
> Add NULL checks for the vlan group pointer in both helpers, returning
> early when there are no VLANs to iterate. This matches the existing
> pattern used by other bridge FDB functions such as br_fdb_add() and
> br_fdb_delete().
>
> Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0")
> Signed-off-by: Zijing Yin <yzjaurora@gmail•com>
Reviewed-by: Ido Schimmel <idosch@nvidia•com>
next prev parent reply other threads:[~2026-04-03 9:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-02 14:01 [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group Zijing Yin
2026-04-03 9:56 ` Ido Schimmel [this message]
2026-04-03 14:59 ` Nikolay Aleksandrov
2026-04-03 22:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260403095629.GA65129@shredder \
--to=idosch@nvidia$(echo .)com \
--cc=bridge@lists$(echo .)linux.dev \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=justinstitt@google$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=llvm@lists$(echo .)linux.dev \
--cc=morbo@google$(echo .)com \
--cc=nathan@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=nick.desaulniers+lkml@gmail$(echo .)com \
--cc=pabeni@redhat$(echo .)com \
--cc=petrm@nvidia$(echo .)com \
--cc=razor@blackwall$(echo .)org \
--cc=yzjaurora@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox