From nobody Fri Aug 14 15:49:54 2026 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8136347606F for ; Fri, 14 Aug 2026 13:41:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714864; cv=none; b=OPipYk8kJvkm7Lmjk0T77dTO7r8dZqMxdWQM61i7CDfSbcR5019X6P/zVQRw+87WA8q97SN6vaVwzsPjnTiG0Khdf2/BqDv5zTUnIQh9oyX12phpETfTckHcc0ltT8gEXSRyzTYIWkPtJH+o+VWdlsDACi9QpWHX1ZFAW0rZz+Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714864; c=relaxed/simple; bh=ZCtbq8/4454INlMgyOXmWQio4JxckUhjzIjAlzKMO7U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SwGPoA+KKq6rnz+WLb/Y7HF3+Kca4LFzi9LQhSEs5A6dQNq82iRWmN2srhetLYR0FTqxNZ0f/akxyht51wBRFYGFM3XEUz5/l5o48p0fbIStLKS6xG0/wqmCA4417W4+y7wh1w/9O9Ks8P3kDkNXNtxetsBywZfDjOSdNPNYN1U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IPF5sU2t; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IPF5sU2t" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2d01663d816so9192825ad.1 for ; Fri, 14 Aug 2026 06:41:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714860; x=1787319660; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=zipcP6cMMo2au5RIIwFC0kV7yCXjZzf04W+orfthdMs=; b=IPF5sU2t+w+zGBXl4fBjW1eQIaPlw1mE7+ayIL8d6oiCv22lIW3VxjNARsUVPUmx0T HE6qdpEE5R42KV06+NtzSZvgg01Wn/dCHl+uJbff7RN3nn1KLCJHm7OX+mR3i81Un4s5 LH9HBXQcbU4XSyz+VHAb9ooI29pZVpmfN/hYAz4/AunQGT6A/heqpyvG1C3qpCWNSPJb cEVDeiQd+P09PRDVfBeQFTq7ISKgt9LLrH+nuoN6e/xfBC+d4tIrK66VloiwaCN95zeN 6HYIu/MNax+DSYdToreIKAD7YfAJgKrtauyUFSrtCxzmZkh1GFPy3/STM7F2fq4PwL9c LJow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714860; x=1787319660; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zipcP6cMMo2au5RIIwFC0kV7yCXjZzf04W+orfthdMs=; b=P3R0EYX/8ubmZjJSPR1ri5t9FGw4ptCbGhJ9AzSgciLlE7cvdDEVCxgNLfNOZanhe7 5hvXvPOuy0E7kXSlFrSMCjVxnSwG+4JqH8hv0Y1H+Rv4P+BEzQ0fDT+tFky/dt4ztPOh rDaG9BWr8epP0nP6I0vBWuv0H3FidMtTol8L/WBSc5O8W6B+odzbkArS0Q7YE8AzKJCw Z8PJd6eoLXzlvB+CGMmO+VXDy/yDx4XBTBtFoRHg/JVZuXLAChbUQie+/Pc+9qHAX2bS xwA2rk1FA07Trf+7OfC9vZZ0TjTjk7rRmXHpsBqHvcGjUJaQdz5YmfI+KteGg/W4H5Ps MroA== X-Forwarded-Encrypted: i=1; AHgh+RoW7GqdbBgkI8t3ZxIl8pQK+ptCM3Vv/1abuPIQZ/0VBf16w7H/17kKhp2HbapzVdzLoUWke48FAwSkj9g=@vger.kernel.org X-Gm-Message-State: AOJu0Yz7FlSx2grZJeVsv7HdKR2l+3RxZSBaCTswRqkRDZOtpOeaxoYx aS3uvw4cz0D6a2sLNCvVnwJY4nBbwnSg8IVsDLN7blhTwDGqMwWNiN3k X-Gm-Gg: AR+sD13loUpbfZeoPwDSM+pXdk26smvjaPVZZh1Ru/ym8a5FS18rcnyGLgcPzUkEBKn sSDHhcGtrJOM9lle00qCGc+YtM0EoEyjyZgJHmOHp5W4oOLgpWiCdxMwrXvdsDXKftX/Z940UO9 0jsEdT+dK7BU0FnuBrdsyl1AxKPfYhc1LW9UQQfHcen9AvvolAPyInfhauZl/O6gp8PYDzA+CxM siv3p1WhqtnBIA64ZkjyRt0SlZHM1fXB3uL5/4WFXdb0VDBkf6CkNAkPjBhoKoySyuDmsI7Guxa LAr4s4gRPigCEa2xrCWwx7v74ORo1K5NxIAxcDVEUvSeOJqOAVu5Zia9CFVzVAvPB1UMqeIkvdB GrWzZjKEthvJZadCA1KukpVE3VjQohYAyQqTfA1baukGtFKi4vkRBXwhHcSyQVEm15dxTl+77Iz JLTT38J7Gdx21Xp/iCeARr0DKznM/NVLM3tza/6sUbHg8YSLpt7S7Lsh2349kuLW6Ib/Q4qAHvl kEX31yy X-Received: by 2002:a17:902:e547:b0:2c1:ee75:56bb with SMTP id d9443c01a7336-2d3b0dc57d3mr63121865ad.20.1786714860112; Fri, 14 Aug 2026 06:41:00 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d3aebc3de2sm9822995ad.70.2026.08.14.06.40.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:40:59 -0700 (PDT) From: Ruoyu Wang To: Nikolay Aleksandrov , Ido Schimmel , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: bridge@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH net] net: bridge: Reject descending VLAN tunnel ranges Date: Fri, 14 Aug 2026 21:40:53 +0800 Message-ID: <20260814134053.1387275-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the u32 tunnel ID subtraction. It can therefore equal the wrapped tunnel ID delta. The range loop then performs no iterations. Since the batched notification handling added a post-loop error check, this leaves err uninitialized and makes the request's return value unpredictable. Reject descending VLAN ranges before comparing the spans. Valid ascending and single-entry ranges remain unchanged, while malformed descending ranges consistently return -EINVAL. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 94339443686b ("net: bridge: notify on vlan tunnel changes done via t= he old api") Signed-off-by: Ruoyu Wang --- net/bridge/br_netlink_tunnel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_netlink_tunnel.c b/net/bridge/br_netlink_tunnel.c index 71a12da30004c..05f560eeb789c 100644 --- a/net/bridge/br_netlink_tunnel.c +++ b/net/bridge/br_netlink_tunnel.c @@ -301,7 +301,8 @@ int br_process_vlan_tunnel_info(const struct net_bridge= *br, =20 if (!(tinfo_last->flags & BRIDGE_VLAN_INFO_RANGE_BEGIN)) return -EINVAL; - if ((tinfo_curr->vid - tinfo_last->vid) !=3D + if (tinfo_curr->vid < tinfo_last->vid || + (tinfo_curr->vid - tinfo_last->vid) !=3D (tinfo_curr->tunid - tinfo_last->tunid)) return -EINVAL; t =3D tinfo_last->tunid; --=20 2.51.0