Le mar. 27 oct. 2026 à 09:52, Linkui Xiao <[email protected]> a écrit : > > From: Linkui Xiao <[email protected]> > > br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over > the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed() > instead of only running the second helper when the first one succeeded. > > When the vlan information no longer fits in the skb but the port has no > vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan > list and returns 0 without touching the skb. The -EMSGSIZE is lost, > br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated, > and the dump carries on to the next interface instead of stopping, so > userspace silently sees an incomplete vlan list. > > Only fill the tunnel information when the vlan information was filled > successfully. > > This was flagged as a pre-existing issue in the Sashiko review of the > net-next series, which noted that the VLAN fill result is overwritten > before it is tested (see the Link tag below). > > Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support") > Link: > https://lore.kernel.org/bridge/[email protected]/T/#u#5 > Signed-off-by: Linkui Xiao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
