This is a note to let you know that I've just added the patch titled
bridge: mcast: Fail MDB get request on empty entry
to the 6.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bridge-mcast-fail-mdb-get-request-on-empty-entry.patch
and it can be found in the queue-6.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 7961aa5c6ecf331ba19c4bf3155b1a57480c71a4
Author: Ido Schimmel <idosch@xxxxxxxxxx>
Date: Sun Sep 29 15:36:40 2024 +0300
bridge: mcast: Fail MDB get request on empty entry
[ Upstream commit 555f45d24ba7cd5527716553031641cdebbe76c7 ]
When user space deletes a port from an MDB entry, the port is removed
synchronously. If this was the last port in the entry and the entry is
not joined by the host itself, then the entry is scheduled for deletion
via a timer.
The above means that it is possible for the MDB get netlink request to
retrieve an empty entry which is scheduled for deletion. This is
problematic as after deleting the last port in an entry, user space
cannot rely on a non-zero return code from the MDB get request as an
indication that the port was successfully removed.
Fix by returning an error when the entry's port list is empty and the
entry is not joined by the host.
Fixes: 68b380a395a7 ("bridge: mcast: Add MDB get support")
Reported-by: Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx>
Closes: https://lore.kernel.org/netdev/c92569919307749f879b9482b0f3e125b7d9d2e3.1726480066.git.jamie.bainbridge@xxxxxxxxx/
Tested-by: Jamie Bainbridge <jamie.bainbridge@xxxxxxxxx>
Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
Acked-by: Nikolay Aleksandrov <razor@xxxxxxxxxxxxx>
Link: https://patch.msgid.link/20240929123640.558525-1-idosch@xxxxxxxxxx
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index bc37e47ad8299..1a52a0bca086d 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -1674,7 +1674,7 @@ int br_mdb_get(struct net_device *dev, struct nlattr *tb[], u32 portid, u32 seq,
spin_lock_bh(&br->multicast_lock);
mp = br_mdb_ip_get(br, &group);
- if (!mp) {
+ if (!mp || (!mp->ports && !mp->host_joined)) {
NL_SET_ERR_MSG_MOD(extack, "MDB entry not found");
err = -ENOENT;
goto unlock;
