[PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[Linkui Xiao]

From: Linkui Xiao <xiaolinkui@kylinos.cn>

br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over
the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed()
instead of only running the second helper when the first one succeeded.

When the vlan information no longer fits in the skb but the port has no
vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan
list and returns 0 without touching the skb. The -EMSGSIZE is lost,
br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated,
and the dump carries on to the next interface instead of stopping, so
userspace silently sees an incomplete vlan list.

Only fill the tunnel information when the vlan information was filled
successfully.

This was flagged as a pre-existing issue in the Sashiko review of the
net-next series, which noted that the VLAN fill result is overwritten
before it is tested (see the Link tag below).

Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support")
Link: https://lore.kernel.org/bridge/ed1de95e-e112-4076-93f0-6f7668e657ad@blackwall.org/T/#u#5
Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
---
 net/bridge/br_netlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index b2cd4e39326d..8ed86bf71a00 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -540,7 +540,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
 		else
 			err = br_fill_ifvlaninfo(skb, vg);
 
-		if (port && test_bit(BR_VLAN_TUNNEL_BIT, &port->flags))
+		if (!err && port && test_bit(BR_VLAN_TUNNEL_BIT, &port->flags))
 			err = br_fill_vlan_tunnel_info(skb, vg);
 		rcu_read_unlock();
 		if (err)
-- 
2.25.1

Re: [PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[Linkui Xiao]

Hi,

Thanks for the notice. Please find the missing information below.

On 2026/10/27 16:55, netdev-bot+sinfo@kernel.org wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>   - Whether the issue was actually triggered, or is only theoretical
>     (e.g. found by code inspection). If it was triggered please include
>     the symptoms, like the stack trace or error messages.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

How the issue was discovered: Found during Sashiko AI review of the 
bridge netlink code. The review identified that 
br_fill_vlan_tunnel_info() could overwrite a previous -EMSGSIZE error 
from br_fill_ifvlaninfo*() when the port has no VLAN-to-tunnel mapping. 
The relevant review comment is already referenced in the commit message 
via the Link: tag.

Whether the issue was actually triggered: Not triggered at runtime. This 
is a theoretical error-path issue found by code inspection/AI review, 
not by syzbot, a static analysis tool scan, or a production report. No 
stack trace or error message was observed, and no test case was written 
to reproduce it.

Testing: The change was compile-tested only. No hardware or runtime test 
was performed, as reproducing the exact -EMSGSIZE + no-tunnel-mapping 
combination requires a specific skb size boundary that was not constructed.

If a v2 is needed for other review reasons, I will include this 
information in the commit messages.

Thanks,
Linkui Xiao

Re: [PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[Eric Dumazet]

Le mar. 27 oct. 2026 à 09:52, Linkui Xiao <xiaolinkui@126.com> a écrit :
>
> From: Linkui Xiao <xiaolinkui@kylinos.cn>
>
> br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over
> the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed()
> instead of only running the second helper when the first one succeeded.
>
> When the vlan information no longer fits in the skb but the port has no
> vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan
> list and returns 0 without touching the skb. The -EMSGSIZE is lost,
> br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated,
> and the dump carries on to the next interface instead of stopping, so
> userspace silently sees an incomplete vlan list.
>
> Only fill the tunnel information when the vlan information was filled
> successfully.
>
> This was flagged as a pre-existing issue in the Sashiko review of the
> net-next series, which noted that the VLAN fill result is overwritten
> before it is tested (see the Link tag below).
>
> Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support")
> Link: https://lore.kernel.org/bridge/ed1de95e-e112-4076-93f0-6f7668e657ad@blackwall.org/T/#u#5
> Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>

Reviewed-by: Eric Dumazet <edumazet@kernel.org>

Re: [PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[Nikolay Aleksandrov]

On 27/10/2026 10:52, Linkui Xiao wrote:
> From: Linkui Xiao <xiaolinkui@kylinos.cn>
> 
> br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over
> the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed()
> instead of only running the second helper when the first one succeeded.
> 
> When the vlan information no longer fits in the skb but the port has no
> vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan
> list and returns 0 without touching the skb. The -EMSGSIZE is lost,
> br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated,
> and the dump carries on to the next interface instead of stopping, so
> userspace silently sees an incomplete vlan list.
> 
> Only fill the tunnel information when the vlan information was filled
> successfully.
> 
> This was flagged as a pre-existing issue in the Sashiko review of the
> net-next series, which noted that the VLAN fill result is overwritten
> before it is tested (see the Link tag below).
> 
> Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support")
> Link: https://lore.kernel.org/bridge/ed1de95e-e112-4076-93f0-6f7668e657ad@blackwall.org/T/#u#5
> Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
> ---
>   net/bridge/br_netlink.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
> index b2cd4e39326d..8ed86bf71a00 100644
> --- a/net/bridge/br_netlink.c
> +++ b/net/bridge/br_netlink.c
> @@ -540,7 +540,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
>   		else
>   			err = br_fill_ifvlaninfo(skb, vg);
>   
> -		if (port && test_bit(BR_VLAN_TUNNEL_BIT, &port->flags))
> +		if (!err && port && test_bit(BR_VLAN_TUNNEL_BIT, &port->flags))
>   			err = br_fill_vlan_tunnel_info(skb, vg);
>   		rcu_read_unlock();
>   		if (err)

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>

Re: [PATCH net] net: bridge: netlink: do not clear the vlan info dump error

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 27 Oct 2026 16:52:00 +0800 you wrote:
> From: Linkui Xiao <xiaolinkui@kylinos.cn>
> 
> br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over
> the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed()
> instead of only running the second helper when the first one succeeded.
> 
> When the vlan information no longer fits in the skb but the port has no
> vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan
> list and returns 0 without touching the skb. The -EMSGSIZE is lost,
> br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated,
> and the dump carries on to the next interface instead of stopping, so
> userspace silently sees an incomplete vlan list.
> 
> [...]

Here is the summary with links:
  - [net] net: bridge: netlink: do not clear the vlan info dump error
    https://git.kernel.org/netdev/net/c/fcc00b15cb21

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html