Re: [PATCH net] bridge: guard local VLAN-0 FDB helpers against NULL vlan group

On Thu, Apr 02, 2026 at 07:01:53AM -0700, Zijing Yin wrote:
> When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and
> nbp_vlan_group() return NULL (br_private.h stub definitions). The
> BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and
> reaches br_fdb_delete_locals_per_vlan_port() and
> br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer
> is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).
> 
> The observed crash is in the delete path, triggered when creating a
> bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0
> via RTM_NEWLINK. The insert helper has the same bug pattern.
> 
>   Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI
>   KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]
>   RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310
>   Call Trace:
>    br_fdb_toggle_local_vlan_0+0x452/0x4c0
>    br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276
>    br_boolopt_toggle net/bridge/br.c:313
>    br_boolopt_multi_toggle net/bridge/br.c:364
>    br_changelink net/bridge/br_netlink.c:1542
>    br_dev_newlink net/bridge/br_netlink.c:1575
> 
> Add NULL checks for the vlan group pointer in both helpers, returning
> early when there are no VLANs to iterate. This matches the existing
> pattern used by other bridge FDB functions such as br_fdb_add() and
> br_fdb_delete().
> 
> Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0")
> Signed-off-by: Zijing Yin <[email protected]>

Reviewed-by: Ido Schimmel <[email protected]>