[Devel] [PATCH vz10] bridge: stp: Fix a potential use-after-free when deleting a bridge

[Vasileios Almpanis]

On Fri, 11 Sep 2026 19:37:52 +0200, Konstantin Khorenko <khorenko at virtuozzo.com> wrote:
> The three STP timers are not supposed to be armed while the bridge is
> administratively down. They are synchronously deactivated when the
> bridge is put administratively down and the various call sites check for
> 'IFF_UP' before arming them.
> 
> This check is missing from br_topology_change_detection() and it is
> possible to engineer a situation in which the topology change timer is
> armed while the bridge is administratively down, resulting in a
> use-after-free [1] when the bridge is deleted.
> 
> [...]

Reviewed-by: Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>

-- 
Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>