From: Cheng Yongkang <[email protected]>
del_nbp() flushes the port's FDB entries before it unregisters the RX
handler. For a normal port, br_stp_disable_port() moves the port to
BR_STATE_DISABLED before this cleanup.
That does not hold for an MRP ring port. br_set_state() ignores state
changes while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves
the port state alone. br_mrp_port_del() then restores forwarding when
the bridge is up before clearing the bit. A frame received between
br_fdb_cleanup_by_dst() and netdev_rx_handler_unregister() can therefore
create a new FDB entry referencing the dying port. Nothing removes that
entry before destroy_nbp_rcu() frees the port, so a later frame to the
learned MAC can be forwarded through the freed port.
Remove the MRP and CFM instances before disabling the port, so that
br_stp_disable_port() actually transitions it to BR_STATE_DISABLED.
With CONFIG_BRIDGE_VLAN_FILTERING=y, synchronize_net() in
nbp_vlan_group_unpublish() also drains receive paths that could still
learn with the old state before the final FDB cleanup.
Found through an LLM-assisted source code analysis workflow and
reproduced on net with KASAN and CONFIG_BRIDGE_VLAN_FILTERING=y in QEMU.
A diagnostic switchdev module accepts MRP objects and delays the
NETDEV_CHANGEUPPER callback for 1.5 s, holding del_nbp() after the FDB
cleanup and before RX handler removal. The reproducer floods the MRP
port with rotating source MACs, waits for the port's RCU callback
through the module's rcu_barrier(), then sends frames to those MACs
from another port. The unpatched kernel reports:
BUG: KASAN: slab-use-after-free in br_forward+0xb1/0x820
Call Trace:
<IRQ>
br_forward+0xb1/0x820
br_handle_frame_finish+0x148b/0x1e50
br_handle_frame+0x90a/0x15c0
With this patch, three runs of six cycles each reach the delay without
a KASAN report.
Fixes: 6536993371fa ("bridge: mrp: Integrate MRP into the bridge")
Suggested-by: Ido Schimmel <[email protected]>
Link: https://lore.kernel.org/netdev/20261012123051.GA714215@shredder/
Closes:
https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Cheng Yongkang <[email protected]>
---
Tested on net cb284914e749 (clang 20, KASAN), with and without this
patch:
- the reproducer above: the unpatched kernel hits the UAF on the first
cycle; the patched kernel completes all cycles without KASAN, WARN
or BUG, and a ping / FDB learning / port detach / bridge delete check
passes
- selftests/net: vlan_bridge_binding.sh, bridge_vlan_dump.sh,
test_bridge_backup_port.sh and forwarding/bridge_vlan_unaware.sh,
bridge_vlan_aware.sh, bridge_fdb_learning_limit.sh,
bridge_sticky_fdb.sh, bridge_port_isolation.sh, bridge_locked_port.sh
pass on both kernels; bridge_stp_mode.sh skips on both (iproute2
without stp_mode support)
- W=1 build of net/bridge/ with allmodconfig: no warnings
v3:
- Re-test on current net (Ido).
- Update the FDB cleanup and VLAN group unpublish names for current net.
- Describe the FDB's reference to the port without the old dst == p
expression.
- Remove the deprecated Assisted-by trailer and describe discovery and
diagnostic instrumentation in plain text.
- Add the original report/reproducer link and links to v1 and v2.
- State the VLAN support prerequisite for the receive-path drain.
v2:
https://lore.kernel.org/netdev/[email protected]/
- Use Ido's MRP/CFM reorder instead of adding a second FDB flush.
- Validate the reorder with the v7.3 reproducer and custom regressions.
v1:
https://lore.kernel.org/netdev/[email protected]/
net/bridge/br_if.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 2c05ebc1299d..fb25ce3e5e64 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -341,13 +341,13 @@ static void del_nbp(struct net_bridge_port *p)
nbp_delete_promisc(p);
+ br_mrp_port_del(br, p);
+ br_cfm_port_del(br, p);
+
spin_lock_bh(&br->lock);
br_stp_disable_port(p);
spin_unlock_bh(&br->lock);
- br_mrp_port_del(br, p);
- br_cfm_port_del(br, p);
-
br_ifinfo_notify(RTM_DELLINK, NULL, p);
list_del_rcu(&p->list);
base-commit: cb284914e749388eef402938bdb3115fe1f6d337
