Diff itself looks OK, but the commit message needs to be adjusted since
it no longer matches current net.git. See below. Please re-test on
current net.git and wait at least 24h before posting v3.
On Thu, Oct 29, 2026 at 09:06:18PM -0700, Cheng Yongkang wrote:
> net: bridge: disable MRP ports before the FDB flush in del_nbp()
>
> del_nbp() flushes the port's FDB entries before it unregisters the RX
> handler. For a normal port, br_stp_disable_port() has already moved the
> port to BR_STATE_DISABLED, so no frame is learned in between.
>
> That does not hold for an MRP ring port. br_set_state() ignores state
> changes while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves
> the port state alone, and br_mrp_port_del() then sets the port to
> BR_STATE_FORWARDING (when the bridge is up) before clearing the bit. A
> frame received between br_fdb_delete_by_port() and
s/br_fdb_delete_by_port/br_fdb_cleanup_by_dst/
> netdev_rx_handler_unregister() is learned with dst == p. Nothing
> removes that entry before destroy_nbp_rcu() frees the port, and a later
> frame to the learned MAC is forwarded to the freed port:
>
> BUG: KASAN: slab-use-after-free in br_forward+0x55/0x3c0
> Read of size 8 at addr ffff8880200bf038 by task mrp-poc/9420
> Call Trace:
> <IRQ>
> br_forward+0x55/0x3c0
> br_handle_frame_finish+0x1300/0x1d40
> br_handle_frame+0x90a/0x15c0
>
> Remove the MRP and CFM instances before disabling the port, so that
> br_stp_disable_port() actually transitions the port to BR_STATE_DISABLED.
> The synchronize_net() in nbp_vlan_flush() then drains the receive paths
s/nbp_vlan_flush/nbp_vlan_group_unpublish/
> that could still learn with the old state, and the FDB flush that
> follows removes their entries. No frame can be learned after that
> flush and before netdev_rx_handler_unregister().
>
> Tested on v7.3 with KASAN and a reproducer that holds del_nbp() in the
> post-FDB-flush/pre-unregister window for 1.5 s while a flood keeps
> sending frames. The unpatched kernel reports the KASAN use-after-free
> above. With this change the same window is exercised in six cycles and
> no KASAN report is produced; normal bridge forwarding, FDB learning and
> port detach also pass.
>
> Fixes: 6536993371fa ("bridge: mrp: Integrate MRP into the bridge")
> Suggested-by: Ido Schimmel <[email protected]>
> Link: https://lore.kernel.org/netdev/20261012123051.GA714215@shredder/
> Assisted-by: LLM
This tag is deprecated since commit 1e035297ffda ("docs: remove
Assisted-by references").
> Signed-off-by: Cheng Yongkang <[email protected]>
> ---
> net/bridge/br_if.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> v2:
> - Implement the reorder suggested by Ido instead of adding a second FDB
> flush after netdev_rx_handler_unregister().
> - The reproducer still exercises the post-flush window; the unpatched
> kernel reports the KASAN use-after-free and the patched kernel does
> not.
> - Regression-tested normal bridge forwarding, FDB learning and port
> detach.
Please also include a link to v1.
v1:
https://lore.kernel.org/netdev/[email protected]/
