From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 7C6428015D for ; Fri, 11 Sep 2026 17:39:11 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68BHbtVF004466; Fri, 11 Sep 2026 20:37:55 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68BHbtVF004466 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="mTToCoJf" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68BHbrxB004462 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 11 Sep 2026 20:37:53 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68BHbrxB004462 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-486f52ac21eso72241f8f.3 for ; Fri, 11 Sep 2026 10:37:53 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxjtMJ48KDM5MwGidOn/hShC7sf49UQVOWHoSElQ3xHcYKD4DDkrvAkx2AuKp6oWnlcJcGn2g==@openvz.org X-Gm-Message-State: AFuF++lPsPjLeYpMFLYhKwtnkRuvn/YJ88jifP0wHBjrunKkjIeEu05w di3wiYzt53a1zVNLxIHqvT0TadtCxuhBNBmo3GEisZDcJnZk/126F7TEULuoX/1rSpU8ZM/aVHr J9JVeeLFJufycBKSu4rCqfuxgWCa4H7WzPxufvMs3djQQVuoYtZjG4g== X-Gm-Gg: AYBFou2Sga3cjFhU3YqCsKqVGsMHqdhbo/JRHvHpE6PEUoCX8JAMrpiHz2iMEHMDEVj 0j8CSAtL9rfQqrxJdhAwsMMtHTvO6G5wChelt3Fe8sfDJBNmKLZtARE/0wHMEA18OvnMAH9jibD eLXG9g92/wy9WrLOdaedwDhES/ciZ/14fMS0yzL2UckupuU8pwwHtYiNJOIPD8Z7B23U4FcVlVh yEhYUpeGZycQVWhzisPkW76Zcnh48dExBux6fZEkjRdTX+Lpbz8Otjz0aUKmQrbfvSTQ46ush4B r5eELWUJahYFhEK66lIwrqX4nASV7AKfLKbflqyBvffdW9X1qzACIcBCNOBYrzwzaXBc+I6/X4U rRpT/krFywdh9Mj0Egg== X-Received: by 2002:a05:6000:1889:b0:485:8be8:b2ba with SMTP id ffacd0b85a97d-486eb3538e3mr7231134f8f.49.1789148273458; Fri, 11 Sep 2026 10:37:53 -0700 (PDT) X-Received: by 2002:a05:6000:1889:b0:485:8be8:b2ba with SMTP id ffacd0b85a97d-486eb3538e3mr7231101f8f.49.1789148273025; Fri, 11 Sep 2026 10:37:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789148273; cv=none; d=google.com; s=arc-20260327; b=oFtxEEFWm6Acy6aWvEdm5PdJyQOt2QUyZkphsSi6CBeUE8y1EHrr7UCD0Tz8B2mq06 NACJcMuLHy0QRcexV8kr2AR1rHXcvnxcjm518yvv/VYu6CauzCNsWK4UoVQToHeZQtY6 uclZ+WB4+72tuciG/twk0/ukFdfWRoJ/t7Pc54HNy0BcO06Yi+60YstNq2pcxMoR+rBl eNCuJe6wGI4DL4kRSo+Ibpdp7EaPsPXxZUFy5j3FeDwQ5UxmluSheQC/yI6gN9iQpzl/ znSAKLKJpBbDPlpBEQYmz5B+n4LZMGsKF9Yf49/C9nyHomct+ZlyI6hAvhizpcGVtUFd z9QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=oxBiVN5fLKBcKvY5+PXOGtUa0Sv6Azycoe76+gK+LeM=; fh=Sx1vz7CguUJD6YekYjGawof0dw6pHonrWYRVHRpFv1M=; b=i89coVqliVrgDGTB9iRhIfjT7xOvcgeOU9XRP1JOV1104HyKzhT6/pIe333nkx4i33 E6T2YstnNRTtmDtyZ5d7k2mdoFssRn1Z+BZ8iIaM4etiq2btciO6UZR41rDsuXR+KyOp fWG6EW8hIRP0vYGrJkUnDY+hNXQ/r1sfrq9YnpQq2t1AVAF1+46CNLT6WCYtn1cZRaG4 URsGbnYiEj+rozxw7R/9iqujSrmfszNxt5JZPS0vPtUVaGlJkFRnEPWcgwS6K53I4GcS 4TtlBQExEQ99xDFfneAr0A2rJMj4YNYEFn2MQat2A53pbpci4SvK9OoXNJoY4uYXltKk jCOA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=mTToCoJf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-486eb36cb17si6123551f8f.105.2026.09.11.10.37.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Sep 2026 10:37:52 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=mTToCoJf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=oxBiVN5fLKBcKvY5+PXOGtUa0Sv6Azycoe76+gK+LeM=; b=mTToCoJfKm8D lkHd/fRfPPlcQpZMwXMB48NYvQKOlXJN1VB1MIOJ2ilSGCnrcgwoe2MBujvARD14sf5Cv8PIAjMpO bPH325yH1J/hLMUK+QEvPERh0ImTdDXwdxqS+YksxBgH1yWOdmZULmDPyKcV4iyk+RxQF6eeSWUeM o6JWsCFHfjmYnIz9zckH1oNddgaKxQ+VZiNCUifhDA8cw9pAGuQFfyOSPOJkO3lTxuLCMhUBBb/b+ 1p8l7W+eXpbO9f7yUSvZV/TsqiQPvh9SgLZyiY9Xvfnry4hzkCHBfGPEieuS7QHzOJnKKI97DuymF A01xfJ5dgY2rnF3d07QV1A==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.vzint.dev) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x559Z-00BqmS-1O; Fri, 11 Sep 2026 19:37:48 +0200 From: Konstantin Khorenko To: Vasileios Almpanis , OpenVZ devel list Date: Fri, 11 Sep 2026 19:37:52 +0200 Message-ID: <20260911173752.2261924-1-khorenko@virtuozzo.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: "Denis V. Lunev" Subject: [Devel] [PATCH vz10] bridge: stp: Fix a potential use-after-free when deleting a bridge X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Ido Schimmel The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put administratively down and the various call sites check for 'IFF_UP' before arming them. This check is missing from br_topology_change_detection() and it is possible to engineer a situation in which the topology change timer is armed while the bridge is administratively down, resulting in a use-after-free [1] when the bridge is deleted. Fix by adding the missing check and for good measures synchronously shutdown the three timers when the bridge is deleted. [1] ODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Noam Rathaus Reported-by: Neil Young Acked-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260629072117.497959-1-idosch@nvidia.com Signed-off-by: Paolo Abeni (cherry picked from commit 2a00517db8de4be7df3d483b215c5544fb30a191) https://virtuozzo.atlassian.net/browse/VSTOR-145092 Feature: fix ms/net Signed-off-by: Konstantin Khorenko --- net/bridge/br_if.c | 3 +++ net/bridge/br_stp.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index b7bf3e0aced66..0fa4d5362d041 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -391,6 +391,9 @@ void br_dev_delete(struct net_device *dev, struct list_head *head) br_fdb_delete_by_port(br, NULL, 0, 1); + timer_shutdown_sync(&br->hello_timer); + timer_shutdown_sync(&br->topology_change_timer); + timer_shutdown_sync(&br->tcn_timer); cancel_delayed_work_sync(&br->gc_work); br_sysfs_delbr(br->dev); diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c index 024210f954683..76a2df165ffc8 100644 --- a/net/bridge/br_stp.c +++ b/net/bridge/br_stp.c @@ -371,7 +371,8 @@ void br_topology_change_detection(struct net_bridge *br) { int isroot = br_is_root_bridge(br); - if (br->stp_enabled != BR_KERNEL_STP) + if (br->stp_enabled != BR_KERNEL_STP || + !(br->dev->flags & IFF_UP)) return; br_info(br, "topology change detected, %s\n", -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel