On 9/11/26 12:50 PM, Nikolay Aleksandrov wrote:
> This is a follow-up of one of sashiko's pre-existing bug reports.
> br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs
> while holding rcu_read_lock() which invokes the blocking switchdev
> notifier chain and may sleep. Nonzero MSTI changes come from netlink
> with rtnl held. Move the switchdev call before entering the rcu section and
> assert that rtnl is held.
>
> The call cannot be deferred because netlink needs its error and extack.
> Also DSA reads the old bridge MST state during the callback and checks it.
> A deferred callback will be late and will see the updated state.
>
> Fixes: 7ae9147f4312 ("net: bridge: mst: Notify switchdev drivers of MST state
> changes")
> Signed-off-by: Nikolay Aleksandrov <[email protected]>
Clashiko noted that the fixes tag looks inaccurate, should be:
Fixes: 3a7c1661ae1383 ("net: bridge: mst: fix vlan use-after-free")
do you agree? I can fix the tag while applying the patch no need to repost.
/P
