From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id ABB2E8015A for ; Fri, 11 Sep 2026 16:12:18 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68BGAwlG004176; Fri, 11 Sep 2026 19:10:59 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68BGAwlG004176 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="lM3uVPyf" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68BGAvUe004172 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 11 Sep 2026 19:10:57 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68BGAvUe004172 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-484337a63bbso613757f8f.3 for ; Fri, 11 Sep 2026 09:10:57 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzox87QnBqvm239iut1QpGpY1BTChwz6FtIPVLV9HrsIabP8YvGmuKxQV1Er/l4/+trF5E3SQ==@openvz.org X-Gm-Message-State: AFuF++kZa6es3e1r7uPy8qcJEmhCrAqG4q8/C1IWlTyl6GOCVxT0b3Wc S1gMm+aMqe/qTwsLTvdu+a0ErNPyhSVhJ3HLENGITJ6LTxFvj6NUBVROQ00conEQQ2SGfPwmluM HnqPXnBVFvpnGihlZv5tAZqaLdkI/yGFk+ZnVpiYPXj4pMgcsydtoAg== X-Gm-Gg: AYBFou36JR41SM4ltlK8fiW5K+TClW94Mkio2UyPNn1TvBqf5UqG26wAuSzH+ohKhXe EWX4NKVPRnCHdPDxCML4meio7eJm/lb6ewap9PYaWSkg8islZlQHnrSFIX5oGI0ohTukew1MPU2 3cinrCA2K2xj5vMeskz4bm9ZjkQKOaGRbXTF5XzSolwivZBp834Dshb+cmT43j3Rq9zSgNQtU7Z KNyv5FzeKhZiC50CUJxEWcDJZLmjPyRzJdDbAQiJ8K+K2FnzsmDQL2sgdpYGDVGDNRK+cJIRt8G Y81QZXIyApJxxVWuN8sXvSRtBiUn1i1seCvtCRjFLF6+1Gwuglbgr8CGYZtOrmciKEaHIZe5CjZ wEuhe65bQffQy0th5rg== X-Received: by 2002:a05:6000:288f:b0:485:8a46:b3be with SMTP id ffacd0b85a97d-486eb32e804mr5744963f8f.38.1789143056634; Fri, 11 Sep 2026 09:10:56 -0700 (PDT) X-Received: by 2002:a05:6000:288f:b0:485:8a46:b3be with SMTP id ffacd0b85a97d-486eb32e804mr5744881f8f.38.1789143055949; Fri, 11 Sep 2026 09:10:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789143055; cv=none; d=google.com; s=arc-20260327; b=om00jyk1VI+0UPoHXL6H/PXVt6pbADC9V+kpVij0cg6sG5gb2r2oqgIBkG1kEfcC4V iGGJ+XYB8sD1+SjZ7GgkEiChi1PYCm/VgUdiy7fPn8XOvuSUOjrtqpImGxvR4Z0vMAsg 12jUsGHH4rbpK8PxonAIhEDkl8L2W8fETHTtzZ02Sqv9VisLNMbuPtU5iAVa9QF1V5+a 8QGnrquRtIsNzszvly0mbl++g4xfSHwfqogmtNZ7f6ul1vQAzWT1jXdF4RVGe4o+nUba EQxaQkdbZ/5jSSgM5G7joVCC+cJ1e+0+z872IpMUv49qJoZNdphz/LuZ5/AGAnAjeTmB GZ1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=9d4ftFTO2kT0GkzJs9URGD4Pkgn/tbvOalwdOVoQm7Y=; fh=bah2+bNzvNvpENwFKZdX9X/cN37ZFXryqKaBrr47zxI=; b=K1XiY9WEP43r0KUviKjjm0mT0rqkux+bDMarQicXIAzbTvtpI5C/SjYqEBVbi58dJL EYh2KGxRs4WE8MGheNPTXFKqmJ7giC4Ga3xmGtQsJjXRBXZb0FrUrul0R3r8ZUsD8FiN lt7ksqBC6Bnnc54kRQ0cFQ77zzzaI6lCaFIQzFHcOZeICwWUowzzGMZb30UFa5b4E5Vh 39R4+Hpot1O+EXToepgPLUAz43Ki1+wVcMzY31Xr8DhDw2EZ/YOuiNnB/J0I4jWjyFpB v0dXlHY1cM73Hyso8Sk+sGM1w5LRKvg+F7q15dlt4R3My7/6IieJ9M73NzP1wVbaW8pQ 7GUA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=lM3uVPyf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-486eb36cb22si5510419f8f.46.2026.09.11.09.10.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Sep 2026 09:10:55 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=lM3uVPyf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=9d4ftFTO2kT0GkzJs9URGD4Pkgn/tbvOalwdOVoQm7Y=; b=lM3uVPyfU6SA YXSoVkAJ7MjX1PdLwasIDJ2cWbQvjmGccNmyPhQbd0qRj14JeEFUucTlAP3Cr116mDpeTqATZXMi4 HxeBpjEX0FuOjNZr29gXU3vU4mkqKY91qhSZ0ePrO4raXqymC4qQrVphkkPX8qPJyvlrTSJ9Q+uFy fkAHEacmsCM669eQUUYjBFkFHDcD8IsJsY8oBuJ0Ywim0kG7q33kvQWmYuwF5VraEWl+p1UnWARJy zkUKc77tCS4PkNd1oQmkxWwuewH+T/wR4e13GxuxDSPAO9sq7ycSeSznbE0018VfNQ/H6hjQ0R7Zh mwXQ9bXZ8vGBxqcoGj4UNA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.vzint.dev) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x53nQ-00AAIl-0a; Fri, 11 Sep 2026 18:10:51 +0200 From: Konstantin Khorenko To: Vasileios Almpanis , OpenVZ devel list Date: Fri, 11 Sep 2026 18:10:54 +0200 Message-ID: <20260911161054.2251394-1-khorenko@virtuozzo.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: "Denis V. Lunev" Subject: [Devel] [PATCH vz7] ms/bridge: stp: Fix a potential use-after-free when deleting a bridge X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Ido Schimmel The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put administratively down and the various call sites check for 'IFF_UP' before arming them. This check is missing from br_topology_change_detection() and it is possible to engineer a situation in which the topology change timer is armed while the bridge is administratively down, resulting in a use-after-free [1] when the bridge is deleted. Fix by adding the missing check and for good measures synchronously shutdown the three timers when the bridge is deleted. [1] ODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Noam Rathaus Reported-by: Neil Young Acked-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260629072117.497959-1-idosch@nvidia.com Signed-off-by: Paolo Abeni (cherry picked from commit 2a00517db8de4be7df3d483b215c5544fb30a191) Changes: - s/timer_shutdown_sync/del_timer_sync/ timer_shutdown_sync() came with ms commit f571faf6e443 ("timers: Provide timer_shutdown[_sync]()") in v6.2, so it does not exist here. There is no stable backport to copy from either: 5.15.y and 6.1.y took this patch unchanged only because that timer API had been backported into them first, and 5.10.y got neither. del_timer_sync() is enough at this call site. Both functions dequeue the timer and wait for a handler already running on another CPU, so on return the timer is neither queued nor running and the following free_netdev() no longer frees a live timer_list. The one thing timer_shutdown_sync() adds is clearing timer->function, which turns a later re-arm into a no-op, and nothing can re-arm these timers by the time br_dev_delete() reaches them: - del_nbp() has already unregistered the rx handler of every port, so no BPDU reaches the bridge; - the remaining arming sites, br_become_root_bridge(), br_received_config_bpdu(), br_topology_change_detection(), br_stp_enable_bridge() and br_stp_start(), run either from that rx path or from ndo_open/ioctl under RTNL, which br_dev_delete() holds; - the handlers themselves are stopped by del_timer_sync(). br_stp_disable_bridge() already uses del_timer_sync() on the same three timers, on a path where the bridge survives and they can legitimately be armed again. https://virtuozzo.atlassian.net/browse/VSTOR-145092 Signed-off-by: Konstantin Khorenko --- net/bridge/br_if.c | 3 +++ net/bridge/br_stp.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index 494293c999c20..8c9d2f0dd055e 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -311,6 +311,9 @@ void br_dev_delete(struct net_device *dev, struct list_head *head) br_fdb_delete_by_port(br, NULL, 0, 1); + del_timer_sync(&br->hello_timer); + del_timer_sync(&br->topology_change_timer); + del_timer_sync(&br->tcn_timer); cancel_delayed_work_sync(&br->gc_work); br_sysfs_delbr(br->dev); diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c index 8f56c2d1f1a70..65b10d3c968b6 100644 --- a/net/bridge/br_stp.c +++ b/net/bridge/br_stp.c @@ -337,7 +337,8 @@ void br_topology_change_detection(struct net_bridge *br) { int isroot = br_is_root_bridge(br); - if (br->stp_enabled != BR_KERNEL_STP) + if (br->stp_enabled != BR_KERNEL_STP || + !(br->dev->flags & IFF_UP)) return; br_info(br, "topology change detected, %s\n", -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel