Re: [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group

On 02/04/2026 17:01, Zijing Yin wrote:
> When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and
> nbp_vlan_group() return NULL (br_private.h stub definitions). The
> BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and
> reaches br_fdb_delete_locals_per_vlan_port() and
> br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer
> is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).
> 
> The observed crash is in the delete path, triggered when creating a
> bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0
> via RTM_NEWLINK. The insert helper has the same bug pattern.
> 
>    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI
>    KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
>    RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310
>    Call Trace:
>     br_fdb_toggle_local_vlan_0+0x452/0x4c0
>     br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276
>     br_boolopt_toggle net/bridge/br.c:313
>     br_boolopt_multi_toggle net/bridge/br.c:364
>     br_changelink net/bridge/br_netlink.c:1542
>     br_dev_newlink net/bridge/br_netlink.c:1575
> 
> Add NULL checks for the vlan group pointer in both helpers, returning
> early when there are no VLANs to iterate. This matches the existing
> pattern used by other bridge FDB functions such as br_fdb_add() and
> br_fdb_delete().
> 
> Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0")
> Signed-off-by: Zijing Yin <[email protected]>
> ---
> Tested on Linux v7.0-rc5 (upstream tag) with clang 20.1.0, KASAN
> enabled, CONFIG_BRIDGE_VLAN_FILTERING=n.
> 
> Bug independently reproduced with the attached C reproducer
> (repro_br_fdb.c). The crash triggers deterministically on the first
> run with CONFIG_BRIDGE_VLAN_FILTERING=n on a clang-built kernel.
> 
> Exact crash signature from reproduction:
> 
>    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI
>    KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
>    RIP: 0010:br_fdb_delete_locals_per_vlan+0x72/0x3f0
>    Call Trace:
>     br_fdb_toggle_local_vlan_0+0x3d/0x1d0
>     br_boolopt_toggle+0xba/0x1a0
>     br_boolopt_multi_toggle+0x129/0x250
>     br_changelink+0x1100/0x1490
>     br_dev_newlink+0x115/0x190
>     rtnl_newlink+0xe15/0x25c0
> 
> Note: gcc 13.3 with the same config optimizes away the NULL dereference
> path (UB elimination), so the crash does not trigger on gcc-built
> kernels. The code is still incorrect regardless of compiler behavior.
> 
> Reproducer (C source): [PASTE_URL_HERE]
> Kernel .config:        [PASTE_URL_HERE]
> 
> To reproduce: compile the C reproducer with `gcc -static -o repro repro.c`,
> run as root on a clang-built kernel. The crash triggers during
> br_dev_newlink() -> br_changelink() when the boolopt toggle reaches
> br_fdb_delete_locals_per_vlan_port() with a NULL vlan group. Note:
> RTM_SETLINK on an existing bridge may not trigger it due to different
> code ordering.
> 
>   net/bridge/br_fdb.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
> index 0501ffcb8..e2c17f620 100644
> --- a/net/bridge/br_fdb.c
> +++ b/net/bridge/br_fdb.c
> @@ -597,6 +597,9 @@ static void br_fdb_delete_locals_per_vlan_port(struct net_bridge *br,
>   		dev = br->dev;
>   	}
>   
> +	if (!vg)
> +		return;
> +
>   	list_for_each_entry(v, &vg->vlan_list, vlist)
>   		br_fdb_find_delete_local(br, p, dev->dev_addr, v->vid);
>   }
> @@ -630,6 +633,9 @@ static int br_fdb_insert_locals_per_vlan_port(struct net_bridge *br,
>   		dev = br->dev;
>   	}
>   
> +	if (!vg)
> +		return 0;
> +
>   	list_for_each_entry(v, &vg->vlan_list, vlist) {
>   		if (!br_vlan_should_use(v))
>   			continue;

Acked-by: Nikolay Aleksandrov <[email protected]>