[BUG] net/bridge: wild access in br_handle_frame_finish()

We found a bug reachable in:

    path    net/bridge
    crash   wild access in br_handle_frame_finish()
    commit  4e15e89faac9 ("net: bnxt: ring the doorbell when SW USO exits early")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: [email protected]

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/a720ac0c47d2d165/patch.diff
        report.md   https://bugs.sh/b/a720ac0c47d2d165/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        [email protected]

== Environment =========================================================
    Reproduced on  4e15e89faac9 ("net: bnxt: ring the doorbell when SW USO exits early")
    VM setup       https://bugs.sh/b/a720ac0c47d2d165/run.sh
    config         https://bugs.sh/b/a720ac0c47d2d165/config.gz
    poc            https://bugs.sh/b/a720ac0c47d2d165/repro.c

== Sanitizer Report ====================================================
Oops: general protection fault, probably for non-canonical address 0xe0001bffe0002001: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x0000ffff00010008-0x0000ffff0001000f]
CPU: 0 UID: 1000 PID: 146 Comm: exploit Not tainted 7.2.0+ #57 PREEMPTLAZY
RIP: 0010:fdb_find_rcu (include/linux/rhashtable.h:152 include/linux/rhashtable.h:629 include/linux/rhashtable.h:672 net/bridge/br_fdb.c:216)
Call Trace:
<IRQ>
br_handle_frame_finish (net/bridge/br_input.c:204 (discriminator 1))
br_nf_hook_thresh (net/bridge/br_netfilter_hooks.c:1165)
br_nf_pre_routing_finish (net/bridge/br_netfilter_hooks.c:430)
br_nf_pre_routing (include/linux/netfilter.h:325 include/linux/netfilter.h:319 net/bridge/br_netfilter_hooks.c:539)
br_handle_frame (include/linux/netfilter.h:165 net/bridge/br_input.c:291 net/bridge/br_input.c:442)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6151)
__netif_receive_skb_one_core (net/core/dev.c:6262)
process_backlog (net/core/dev.c:6377 net/core/dev.c:6728)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
do_softirq.part.0 (kernel/softirq.c:546 (discriminator 20))
</IRQ>
__local_bh_enable_ip (kernel/softirq.c:538 kernel/softirq.c:473)
__dev_queue_xmit (include/linux/bottom_half.h:33 (discriminator 1) include/linux/rcupdate.h:914 (discriminator 1) net/core/dev.c:4961 (discriminator 1))
packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)
__sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 (discriminator 1) net/socket.c:2281 (discriminator 1))
__x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to [email protected]

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup