On 20/09/2026 14:08, Fourie Zhang wrote:
br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory.A following RTM_GETMDB exposes the dangling pointer: BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress. Fixes: a6acb535afb2 ("bridge: mdb: Add MDB bulk deletion support") Cc: [email protected] Assisted-by: tencentos-corvus-ai:hy4-preview Signed-off-by: Fourie Zhang <[email protected]> --- A reproducer for this issue is available if requested. net/bridge/br_mdb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c index e0c7020b1..a01bd280c 100644 --- a/net/bridge/br_mdb.c +++ b/net/bridge/br_mdb.c @@ -1523,6 +1523,8 @@ static void br_mdb_flush_pgs(struct net_bridge *br, }br_multicast_del_pg(mp, p, pp);+ /* br_multicast_del_pg() can remove other groups from this list. */ + pp = &mp->ports; } }
Yeah, this seems like the simplest fix for stable. I will post my conversion to standard list primitives and will remove these issues altogether with it in net-next. Acked-by: Nikolay Aleksandrov <[email protected]>
