linux-kernel - Re: [PATCH net] net: bridge: Do not offload IGMP/MLD messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a55nyofq.fsf@waldekranz.com>
Date: Wed, 02 Jul 2025 10:41:45 +0200
From: Tobias Waldekranz <tobias@...dekranz.com>
To: Joseph Huang <Joseph.Huang@...min.com>, netdev@...r.kernel.org
Cc: Joseph Huang <Joseph.Huang@...min.com>, Nikolay Aleksandrov
 <razor@...ckwall.org>, Ido Schimmel <idosch@...dia.com>, "David S. Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
 <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman
 <horms@...nel.org>, Florian Fainelli <f.fainelli@...il.com>, Vladimir
 Oltean <vladimir.oltean@....com>, bridge@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: bridge: Do not offload IGMP/MLD messages

On tis, jul 01, 2025 at 15:36, Joseph Huang <Joseph.Huang@...min.com> wrote:
> Do not offload IGMP/MLD messages as it could lead to IGMP/MLD Reports
> being unintentionally flooded to Hosts. Instead, let the bridge decide
> where to send these IGMP/MLD messages.

Hi Joseph,

Do I understand the situation correctly that this is the case where the
local host is sending out reports in response to a remote querier?

       mcast-listener-process (IP_ADD_MEMBERSHIP)
          \
          br0
         /   \
      swp1   swp2
        |     |
  QUERIER     SOME-OTHER-HOST

So in the above setup, br0 will want to br_forward() reports for
mcast-listener-process's group(s) via swp1 to QUERIER; but since the
source hwdom is 0, the report is eligible for tx offloading, and is
flooded by hardware to both swp1 and swp2, reaching SOME-OTHER-HOST as
well?

> Fixes: 472111920f1c ("net: bridge: switchdev: allow the TX data plane forwarding to be offloaded")
> Signed-off-by: Joseph Huang <Joseph.Huang@...min.com>
> ---
>  net/bridge/br_switchdev.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c
> index 95d7355a0407..757c34bf5931 100644
> --- a/net/bridge/br_switchdev.c
> +++ b/net/bridge/br_switchdev.c
> @@ -18,7 +18,8 @@ static bool nbp_switchdev_can_offload_tx_fwd(const struct net_bridge_port *p,
>  		return false;
>  
>  	return (p->flags & BR_TX_FWD_OFFLOAD) &&
> -	       (p->hwdom != BR_INPUT_SKB_CB(skb)->src_hwdom);
> +	       (p->hwdom != BR_INPUT_SKB_CB(skb)->src_hwdom) &&
> +	       !br_multicast_igmp_type(skb);
>  }
>  
>  bool br_switchdev_frame_uses_tx_fwd_offload(struct sk_buff *skb)
> -- 
> 2.49.0