The simple_strtoul() function is deprecated. It does not handle
errors or overflows correctly. Replace it with kstrtoul() in
brport_store() to ensure that invalid user input is caught and
returned as an error.

Signed-off-by: Aadarsh Chandra <aadarsh.official.xz@gmail.com>
---
 net/bridge/br_sysfs_if.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 1f57c36a7fc0..3e948d781970 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -318,7 +318,7 @@ static ssize_t brport_store(struct kobject *kobj,
 	struct net_bridge_port *p = kobj_to_brport(kobj);
 	ssize_t ret = -EINVAL;
 	unsigned long val;
-	char *endp;
+	int err;
 
 	if (!ns_capable(dev_net(p->dev)->user_ns, CAP_NET_ADMIN))
 		return -EPERM;
@@ -339,9 +339,11 @@ static ssize_t brport_store(struct kobject *kobj,
 		spin_unlock_bh(&p->br->lock);
 		kfree(buf_copy);
 	} else if (brport_attr->store) {
-		val = simple_strtoul(buf, &endp, 0);
-		if (endp == buf)
+		err = kstrtoul(buf, 0, &val);
+		if (err) {
+			ret = err;
 			goto out_unlock;
+		}
 		spin_lock_bh(&p->br->lock);
 		ret = brport_attr->store(p, val);
 		spin_unlock_bh(&p->br->lock);
-- 
2.54.0

On 04/05/2026 18:01, Aadarsh Chandra wrote:
> The simple_strtoul() function is deprecated. It does not handle
> errors or overflows correctly. Replace it with kstrtoul() in
> brport_store() to ensure that invalid user input is caught and
> returned as an error.
> 
> Signed-off-by: Aadarsh Chandra <aadarsh.official.xz@gmail.com>
> ---
>   net/bridge/br_sysfs_if.c | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 

This patch should be targeted at net-next (PATCH net-next in subject).

> diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
> index 1f57c36a7fc0..3e948d781970 100644
> --- a/net/bridge/br_sysfs_if.c
> +++ b/net/bridge/br_sysfs_if.c
> @@ -318,7 +318,7 @@ static ssize_t brport_store(struct kobject *kobj,
>   	struct net_bridge_port *p = kobj_to_brport(kobj);
>   	ssize_t ret = -EINVAL;
>   	unsigned long val;
> -	char *endp;
> +	int err;
>   
>   	if (!ns_capable(dev_net(p->dev)->user_ns, CAP_NET_ADMIN))
>   		return -EPERM;
> @@ -339,9 +339,11 @@ static ssize_t brport_store(struct kobject *kobj,
>   		spin_unlock_bh(&p->br->lock);
>   		kfree(buf_copy);
>   	} else if (brport_attr->store) {
> -		val = simple_strtoul(buf, &endp, 0);
> -		if (endp == buf)
> +		err = kstrtoul(buf, 0, &val);

You can just use ret = kstrtoul() here and make this simpler, ssize_t is an
int on 32 bit archs and a long on 64 bit ones, so it can hold the return val.

> +		if (err) {
> +			ret = err;
>   			goto out_unlock;
> +		}
>   		spin_lock_bh(&p->br->lock);
>   		ret = brport_attr->store(p, val);
>   		spin_unlock_bh(&p->br->lock);

Cheers,
  Nik