[Devel] [PATCH vz7] ms/bridge: stp: Fix a potential use-after-free when deleting a bridge

[Vasileios Almpanis]

On 9/11/26 6:10 PM, Konstantin Khorenko wrote:
> From: Ido Schimmel <idosch at nvidia.com>
>
> The three STP timers are not supposed to be armed while the bridge is
> administratively down. They are synchronously deactivated when the
> bridge is put administratively down and the various call sites check for
> 'IFF_UP' before arming them.
>
> This check is missing from br_topology_change_detection() and it is
> possible to engineer a situation in which the topology change timer is
> armed while the bridge is administratively down, resulting in a
> use-after-free [1] when the bridge is deleted.
>
> [...]

Reviewed-by: Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>

-- 
Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>