[SRU][N][PATCH 0/1] CVE-2025-40297

[Tim Whisonant]

SRU Justification:

[Impact]

net: bridge: fix use-after-free due to MST port state bypass

syzbot reported[1] a use-after-free when deleting an expired fdb. It is
due to a race condition between learning still happening and a port being
deleted, after all its fdbs have been flushed. The port's state has been
toggled to disabled so no learning should happen at that time, but if we
have MST enabled, it will bypass the port's state, that together with VLAN
filtering disabled can lead to fdb learning at a time when it shouldn't
happen while the port is being deleted. VLAN filtering must be disabled
because we flush the port VLANs when it's being deleted which will stop
learning. This fix adds a check for the port's vlan group which is
initialized to NULL when the port is getting deleted, that avoids the port
state bypass. When MST is enabled there would be a minimal new overhead
in the fast-path because the port's vlan group pointer is cache-hot.

[1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be

[Fix]

Questing: fixed separately
Noble:    cherry picked from upstream
Jammy:    not affected
Focal:    not affected
Bionic:   not affected
Xenial:   not affected
Trusty:   not affected

[Test Plan]

Compile and boot tested.

[Where problems could occur]

The changes prevent a use-after-free scenario in the networking
stack, specifically when deleting a forwarding database when
in Multiple Spanning Tree mode. Issues might appear as errors
in the port learning and fowarding state machine.

Nikolay Aleksandrov (1):
  net: bridge: fix use-after-free due to MST port state bypass

 net/bridge/br_forward.c | 2 +-
 net/bridge/br_input.c   | 4 ++--
 net/bridge/br_private.h | 8 +++++---
 3 files changed, 8 insertions(+), 6 deletions(-)

-- 
2.43.0