Hi, This fixes the syzbot report "WARNING in nf_ct_bridge_post":
https://syzkaller.appspot.com/bug?extid=a8ba738fe2db6b4bb27f It has been open since November 2025 and has a C reproducer. With vlan_filtering on, a frame whose tag protocol differs from the bridge's vlan_protocol (802.1Q on an 802.1ad bridge, or the other way round) gets its tag moved back into the packet after bridge conntrack has defragmented it. In postrouting nf_ct_bridge_refrag() no longer recognises the protocol, warns and drops it. The warning is only part of it. Fragmented IPv4 and IPv6 packets through such a bridge are dropped, everything else works, so it looks like an MTU problem: a 3000 byte ping in an 802.1Q vlan across an 802.1ad bridge with bridge conntrack gets no reply, across an 802.1Q bridge it does. Patch 1 skips over the tag in nf_ct_bridge_refrag() and puts it back on each fragment. Patch 2 adds a selftest for it. The Fixes: tags in patch 1 are the initial bridge conntrack support and its IPv6 support, both from v5.3. I tested this in QEMU guests on 7.3 and on v5.4, v6.1, v6.12 and v7.2, on arm64 and on x86_64 with KVM. The selftest fails on all of them without patch 1 (the control passes, the six other pings fail and the kernel warns) and passes with it. The frame from the syzbot reproducer warns without patch 1 and does not with it. On a kernel with KASAN, lockdep, DEBUG_ATOMIC_SLEEP, kmemleak and DEBUG_NET the selftest shows nothing, and neither do packets whose inner ethertype an nft postrouting rule rewrites after defragmentation (to ARP, and IPv4/IPv6 labelled as each other): they are dropped without a warning or a leak. It builds without warnings with W=1 and CONFIG_IPV6=n or CONFIG_BRIDGE_VLAN_FILTERING=n, and checkpatch.pl --strict is clean. A tagged egress port (hardware tag together with the in-band tag), jumbo frames, and br_netfilter enabled together with bridge conntrack were also run: all fail on the unpatched kernel and pass with patch 1, except a smaller egress mtu, where the 802.1Q bridge behaves the same. Thanks, Laveesh Laveesh Bansal (2): netfilter: bridge: refragment packets with a vlan tag moved by the bridge selftests: netfilter: add bridge conntrack test for vlan protocol mismatch include/linux/netfilter_bridge.h | 4 + net/bridge/netfilter/nf_conntrack_bridge.c | 43 ++++- .../testing/selftests/net/netfilter/Makefile | 1 + .../net/netfilter/bridge_ct_vlan_proto.sh | 182 ++++++++++++++++++ tools/testing/selftests/net/netfilter/config | 1 + 5 files changed, 227 insertions(+), 4 deletions(-) create mode 100755 tools/testing/selftests/net/netfilter/bridge_ct_vlan_proto.sh -- 2.54.0 (Apple Git-157)
