On Mon, Aug 31, 2026 at 07:30:51PM +0800, Zhao ShiRong wrote: > Packets locally delivered by the bridge are re-injected into the > receive path via br_pass_frame_up() -> br_netif_receive_skb() -> > netif_receive_skb() with skb->dev set to the bridge device. If the > bridge device has an XDP program attached, __netif_receive_skb_core() > runs do_xdp_generic() a second time on such packets. > > A locally-delivered packet that was allocated on the TX path (e.g. an > MLD packet built by mld_newpack()) does not carry the > XDP_PACKET_HEADROOM that generic XDP requires, so > netif_skb_check_for_xdp() calls pskb_expand_head() and reallocates the > skb head buffer. This frees the head that the bridge rx path > (br_handle_frame() / br_handle_frame_finish()) is still using, leading > to a use-after-free read in br_handle_frame(): > > BUG: KASAN: slab-use-after-free in is_multicast_ether_addr [inline] > BUG: KASAN: slab-use-after-free in is_valid_ether_addr [inline] > BUG: KASAN: slab-use-after-free in br_handle_frame+0xcfb/0x1510 > net/bridge/br_input.c:349 > > netif_receive_generic_xdp() already refuses to run generic XDP on > reinjected packets by checking skb_is_redirected(). Reuse that marker: > set it right before the bridge re-injects the packet, so generic XDP is > skipped and the head buffer is left intact. > > Reported-by: [email protected] > Link: > https://lore.kernel.org/all/[email protected]/T/ > Signed-off-by: Zhao ShiRong <[email protected]>
Eric sent a fix for this issue earlier today: https://lore.kernel.org/netdev/[email protected]/
