On 13/04/2026 12:08, Ren Wei wrote:
From: Zhengchuan Liang <[email protected]>

Local FDB entries can be rewritten in place by `fdb_delete_local()`, which
updates `f->dst` to another port or to `NULL` while keeping the entry
alive. Several bridge RCU readers inspect `f->dst`, including
`br_fdb_fillbuf()` through the `brforward_read()` sysfs path.

These readers currently load `f->dst` multiple times and can therefore
observe inconsistent values across the check and later dereference.
In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change
`f->dst` after the NULL check and before the `port_no` dereference,
leading to a NULL-ptr-deref.

Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each
affected RCU reader and using that snapshot for the rest of the access
sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()`
with `WRITE_ONCE()` so the readers and writer use matching access patterns.

Fixes: 960b589f86c7 ("bridge: Properly check if local fdb entry can be deleted in 
br_fdb_change_mac_address")
Cc: [email protected]
Reported-by: Yifan Wu <[email protected]>
Reported-by: Juefei Pu <[email protected]>
Co-developed-by: Yuan Tan <[email protected]>
Signed-off-by: Yuan Tan <[email protected]>
Suggested-by: Xin Liu <[email protected]>
Tested-by: Ren Wei <[email protected]>
Signed-off-by: Zhengchuan Liang <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
  net/bridge/br_arp_nd_proxy.c |  8 +++++---
  net/bridge/br_fdb.c          | 28 ++++++++++++++++++----------
  2 files changed, 23 insertions(+), 13 deletions(-)


Acked-by: Nikolay Aleksandrov <[email protected]>

Reply via email to