netdev - [PATCH net 2/2] selftests: forwarding: bridge: add a state bypass with disabled VLAN filtering test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251104120313.1306566-3-razor@blackwall.org>
Date: Tue,  4 Nov 2025 14:03:13 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: netdev@...r.kernel.org
Cc: tobias@...dekranz.com,
	idosch@...dia.com,
	kuba@...nel.org,
	davem@...emloft.net,
	bridge@...ts.linux.dev,
	pabeni@...hat.com,
	edumazet@...gle.com,
	horms@...nel.org,
	Nikolay Aleksandrov <razor@...ckwall.org>
Subject: [PATCH net 2/2] selftests: forwarding: bridge: add a state bypass with disabled VLAN filtering test

Add a test which checks that port state bypass cannot happen if we have
VLAN filtering disabled and MST enabled. Such bypass could lead to race
condition when deleting a port because learning may happen after its
state has been toggled to disabled while it's being deleted, leading to
a use after free.

Signed-off-by: Nikolay Aleksandrov <razor@...ckwall.org>
---
 .../net/forwarding/bridge_vlan_unaware.sh     | 35 ++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
index 2b5700b61ffa..20769793310e 100755
--- a/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding pvid_change"
+ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding pvid_change mst_state_no_bypass"
 NUM_NETIFS=4
 source lib.sh
 
@@ -114,6 +114,39 @@ pvid_change()
 	ping_ipv6 " with bridge port $swp1 PVID deleted"
 }
 
+mst_state_no_bypass()
+{
+	local mac=de:ad:be:ef:13:37
+
+	# Test that port state isn't bypassed when MST is enabled and VLAN
+	# filtering is disabled
+	RET=0
+
+	# MST can be enabled only when there are no VLANs
+	bridge vlan del vid 1 dev $swp1
+	bridge vlan del vid 1 dev $swp2
+	bridge vlan del vid 1 dev br0 self
+
+	ip link set br0 type bridge mst_enabled 1
+	check_err $? "Could not enable MST"
+
+	bridge link set dev $swp1 state disabled
+	check_err $? "Could not set port state"
+
+	$MZ $h1 -c 1 -p 64 -a $mac -t ip -q
+
+	bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
+	check_fail $? "FDB entry found when it shouldn't be"
+
+	log_test "VLAN filtering disabled and MST enabled port state no bypass"
+
+	ip link set br0 type bridge mst_enabled 0
+	bridge link set dev $swp1 state forwarding
+	bridge vlan add vid 1 dev $swp1 pvid untagged
+	bridge vlan add vid 1 dev $swp2 pvid untagged
+	bridge vlan add vid 1 dev br0 self
+}
+
 trap cleanup EXIT
 
 setup_prepare
-- 
2.51.0