On Mon, 28 Sept 2026 at 00:31, Andrew Lunn <[email protected]> wrote: > > On Sun, Sep 27, 2026 at 01:04:38AM +0800, Ren Wei wrote: > > From: Zixuan Chai <[email protected]> > > > > Hi Linux kernel maintainers, > > > > We found and validated an issue in net/bridge/br_multicast.c. The bug is > > reachable by a non-root user via user and network namespaces. We've tested > > it, and it should not affect any other bridge multicast functionality. > > > > This bug is tracked at: https://bugtracker.nebusec.ai/f/4342 > > > > We will provide detailed information about the bug in this email, along > > with a PoC to trigger it. > > > > ---- details below ---- > > > > Bug details: > > > > When an EXCLUDE (*,G) port is deleted, br_multicast_star_g_handle_mode() > > removes its corresponding temporary STAR_EXCL (S,G) port. For an (S,G) > > entry, br_multicast_del_pg() then calls > > br_multicast_sg_del_exclude_ports() to remove the remaining automatically > > added ports. That helper also calls br_multicast_del_pg() for each port, > > which re-enters the same cleanup and adds another stack frame per port. > > With enough ports, the task hits the kernel stack guard page. > > What is the value of "enough"?
Thanks for your review. By "enough", we mean 151 temporary EXCLUDE ports in our tested setup. This is the smallest number of ports we have tested that triggers the issue. > We get lots of bug reports for theoretical issues which in practice > will never happen. And we get some reports for real issues which can > happen. You are more likely to get your reported looked at if you make > it clear the issues really can happen, give todays systems. > > > The PoC uses unshare -Urn, creates 256 temporary EXCLUDE ports and a > > permanent INCLUDE source entry with IGMPv3 enabled, then deletes one > > EXCLUDE port. > > So a hardware switch with 256 ports is on the high side, but this > could happen in an SDN setup. We also believe this is realistic in SDN and container setups, where a single bridge can have hundreds of virtual ports. Thanks, Zixuan Chai
