From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78D623C5540 for ; Fri, 3 Apr 2026 14:59:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775228352; cv=none; b=K0WPWrEZ3iTwwm/bdj5faBYDUo9p9rlmgnee7zeWCdNCn8Dnylge69KUuvdo5+vzwdcMV6k27tzWkjgFE42FR3f6lR7Lmd3dCbh7vFJvF8BNJeOQbEtJhhIBBvSYT66Qe2wVtHWKmLgy2khrI6EZKveN1blphfye1hqMcYwxmDU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775228352; c=relaxed/simple; bh=Xbc4Ra681nc48aNuM3ATdRJApIcuteTB0BIdE8dIwPE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=NnNuY4a9MPgrupB7u3mrrQ6LpOSpmKBxCtnQaspXiXaPqY5wGsvc9xFw9+Xs5tVKuQ84VYbS2OJ0sDHaArjcYzE02Q1o/0T9/+igwfTz8B+qii88LuQ0LJFRAH6MgGDct74uHtf/VWp9S2ejQndwN7b8Hg/P15ahaiFycQUlkUM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org; spf=none smtp.mailfrom=blackwall.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b=Pek+yKed; arc=none smtp.client-ip=209.85.221.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=blackwall.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b="Pek+yKed" Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-43cfac48bc7so1122543f8f.0 for ; Fri, 03 Apr 2026 07:59:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall.org; s=google; t=1775228349; x=1775833149; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=kGPv9Bco5NsmxbV6+XT6L0Y0xbtKDX3C4wt1tJqNE8Q=; b=Pek+yKed/p/gP0CKwElduNgaMtMzNXgHpli/3hVJJy9b4yXOlHNwa9ASUHroWDKE8f kpE1Z1thIg27hYOkyG3HOakIQF+dyX9fCUOENEklsGb7/iowZbKCDrvABvsKgGmmHyzs wM3DT5p2WjKWNUEva529aI2iiR/Sm3lgQMdF3kHOYzCKioEJOkKfRfL63v1PdRfH9nrz DShwFKmIzNoA26P+eFj/JTz8JB5Y5Lq9ia9Pub6n5Xj4Gfb6oumQPGh4f33CRG1sKPpJ TacuG7aWQVBV+h+vPmgn+rRq4xV2sFJYWHu1QnoT0uXx1VMcaM6Dhf24/KOq6bRcncfL RNxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775228349; x=1775833149; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=kGPv9Bco5NsmxbV6+XT6L0Y0xbtKDX3C4wt1tJqNE8Q=; b=ol30fGteP+3iwTfNPbVhdDB6J+LtHBoBq1o2lI8hE1ENABn387SVU5B4Edxn35XCou 56c3wyH1LFDOn5CAts+WpDrVy0irnkMPCffTYEU5K7W9T8IxmZtnNj8XuZlul+8tPMKV 8DezbX/kuefPqYM7m2s+UN0mm/azFbaimHsH1kWW9OoIPtgkJi0NSD52Hin4nXY8FiIY ahky+3/utoRywnCPHhk3JAaPTID2Owo6WlLDJjrvbQaWlCecyqli4kfzVMRTJJg/VnZe ajUfzNGBxua+1th92iPpzXH2W6MVA6dkU219v7GKcPVVd6/hPREwYIYbyOvj1vXb0p+K KgOA== X-Forwarded-Encrypted: i=1; AJvYcCU+xp0VZ9nhVaytR/HANWhaWTiELLP/W3hC9o4z9/Hf7STKvjnbOygkKFZNehLf1VKZB0oRFpnn6A4UOX4=@vger.kernel.org X-Gm-Message-State: AOJu0YzZZ0rXr6/urF47k6c8L61G1XdoIX87GIuXlU/TUNHuIhpKP2fA k/p0M1DuymfrI6K9rvlMldW+3xFw7bjBjs18HU8slrv49RkxoHWFWAZo9Hf91YbuAes= X-Gm-Gg: AeBDievGoYmjwBi0z4jG/7UPXEU9MUyt6RJfrWtSM8fM+jVbG6ahZMmkqsq8sakze8u KrNueFXvkXm2KjFel18wR9tw25QZTsAg9WBaicBy4ENr3KTtvaxDHZDgQ60bAT7xW92wQEb3/W5 i+cJelKBAfQBl6inXC6VbmHFyOUTUXKGGwzaKn69yFA2dunI0wOyTD3buEeXC7rESZGoy574mAm /VdKu7mXjY4nT6kEGCuwOnyqRX+eTEPrKWfA/EPAHEHJyKl44WJGVS02XeWCqmzo/4Y/T/ZAzC9 9tpJdBj+F0DvBZSPdJ2cMjPbDr+LANfzgZ8ezN7yXaO8JLLPyFZiDXL4W2Ql0T/iBBhQVwF50LP uqyCU4KRaNNbJF7z+IW3w+ezNnCwUYnFoxZ0eRHlCOn0L5/gA38ITYgPHM1XhZJGJta6hs3kH7B fVE0tLxFJI5t7VZamOxA3prbpDZoB3M5D4JDKI7xxMAFbEZcPQIbvnXQ== X-Received: by 2002:a05:6000:4382:b0:43d:60d:944b with SMTP id ffacd0b85a97d-43d292f1452mr5756991f8f.37.1775228348596; Fri, 03 Apr 2026 07:59:08 -0700 (PDT) Received: from [192.168.0.161] (78-154-15-182.ip.btc-net.bg. [78.154.15.182]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43d1e4f1a99sm18426635f8f.32.2026.04.03.07.59.07 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 03 Apr 2026 07:59:08 -0700 (PDT) Message-ID: <98bdaf08-6bff-4ea3-9e74-65b41da1447b@blackwall.org> Date: Fri, 3 Apr 2026 17:59:06 +0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group To: Zijing Yin , netdev@vger.kernel.org Cc: bridge@lists.linux.dev, idosch@nvidia.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, nathan@kernel.org, nick.desaulniers+lkml@gmail.com, morbo@google.com, justinstitt@google.com, petrm@nvidia.com, linux-kernel@vger.kernel.org, llvm@lists.linux.dev References: <20260402140153.3925663-1-yzjaurora@gmail.com> Content-Language: en-US From: Nikolay Aleksandrov In-Reply-To: <20260402140153.3925663-1-yzjaurora@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 02/04/2026 17:01, Zijing Yin wrote: > When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and > nbp_vlan_group() return NULL (br_private.h stub definitions). The > BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and > reaches br_fdb_delete_locals_per_vlan_port() and > br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer > is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist). > > The observed crash is in the delete path, triggered when creating a > bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 > via RTM_NEWLINK. The insert helper has the same bug pattern. > > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI > KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] > RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310 > Call Trace: > br_fdb_toggle_local_vlan_0+0x452/0x4c0 > br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276 > br_boolopt_toggle net/bridge/br.c:313 > br_boolopt_multi_toggle net/bridge/br.c:364 > br_changelink net/bridge/br_netlink.c:1542 > br_dev_newlink net/bridge/br_netlink.c:1575 > > Add NULL checks for the vlan group pointer in both helpers, returning > early when there are no VLANs to iterate. This matches the existing > pattern used by other bridge FDB functions such as br_fdb_add() and > br_fdb_delete(). > > Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0") > Signed-off-by: Zijing Yin > --- > Tested on Linux v7.0-rc5 (upstream tag) with clang 20.1.0, KASAN > enabled, CONFIG_BRIDGE_VLAN_FILTERING=n. > > Bug independently reproduced with the attached C reproducer > (repro_br_fdb.c). The crash triggers deterministically on the first > run with CONFIG_BRIDGE_VLAN_FILTERING=n on a clang-built kernel. > > Exact crash signature from reproduction: > > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI > KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] > RIP: 0010:br_fdb_delete_locals_per_vlan+0x72/0x3f0 > Call Trace: > br_fdb_toggle_local_vlan_0+0x3d/0x1d0 > br_boolopt_toggle+0xba/0x1a0 > br_boolopt_multi_toggle+0x129/0x250 > br_changelink+0x1100/0x1490 > br_dev_newlink+0x115/0x190 > rtnl_newlink+0xe15/0x25c0 > > Note: gcc 13.3 with the same config optimizes away the NULL dereference > path (UB elimination), so the crash does not trigger on gcc-built > kernels. The code is still incorrect regardless of compiler behavior. > > Reproducer (C source): [PASTE_URL_HERE] > Kernel .config: [PASTE_URL_HERE] > > To reproduce: compile the C reproducer with `gcc -static -o repro repro.c`, > run as root on a clang-built kernel. The crash triggers during > br_dev_newlink() -> br_changelink() when the boolopt toggle reaches > br_fdb_delete_locals_per_vlan_port() with a NULL vlan group. Note: > RTM_SETLINK on an existing bridge may not trigger it due to different > code ordering. > > net/bridge/br_fdb.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c > index 0501ffcb8..e2c17f620 100644 > --- a/net/bridge/br_fdb.c > +++ b/net/bridge/br_fdb.c > @@ -597,6 +597,9 @@ static void br_fdb_delete_locals_per_vlan_port(struct net_bridge *br, > dev = br->dev; > } > > + if (!vg) > + return; > + > list_for_each_entry(v, &vg->vlan_list, vlist) > br_fdb_find_delete_local(br, p, dev->dev_addr, v->vid); > } > @@ -630,6 +633,9 @@ static int br_fdb_insert_locals_per_vlan_port(struct net_bridge *br, > dev = br->dev; > } > > + if (!vg) > + return 0; > + > list_for_each_entry(v, &vg->vlan_list, vlist) { > if (!br_vlan_should_use(v)) > continue; Acked-by: Nikolay Aleksandrov