Thanks for the quick review.
On Fri, Mar 27, 2026 at 11:44 PM Nikolay Aleksandrov
<[email protected]> wrote:
>
> On 28/03/2026 08:30, Xiang Mei wrote:
> > br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied
> > interval value from netlink without validation. When interval is 0,
> > usecs_to_jiffies(0) yields 0, causing the delayed work
> > (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule
> > itself with zero delay. This creates a tight loop on system_percpu_wq
> > that allocates and transmits MRP test frames at maximum rate, exhausting
> > all system memory and causing a kernel panic via OOM deadlock.
> >
> > The same zero-interval issue applies to br_mrp_start_in_test_parse()
> > for interconnect test frames.
> >
> > Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both
> > IFLA_BRIDGE_MRP_START_TEST_INTERVAL and
> > IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the
> > netlink attribute parsing layer before the value ever reaches the
> > workqueue scheduling code. This is consistent with how other bridge
> > subsystems (br_fdb, br_mst) enforce range constraints on netlink
> > attributes.
> >
> > Fixes: 20f6a05ef635 ("bridge: mrp: Rework the MRP netlink interface")
> > Fixes: 7ab1748e4ce6 ("bridge: mrp: Extend MRP netlink interface for
> > configuring MRP interconnect")
> > Reported-by: Weiming Shi <[email protected]>
> > Signed-off-by: Xiang Mei <[email protected]>
> > ---
> > net/bridge/br_mrp_netlink.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/bridge/br_mrp_netlink.c b/net/bridge/br_mrp_netlink.c
> > index ce6f63c77cc0..86f0e75d6e34 100644
> > --- a/net/bridge/br_mrp_netlink.c
> > +++ b/net/bridge/br_mrp_netlink.c
> > @@ -196,7 +196,7 @@ static const struct nla_policy
> > br_mrp_start_test_policy[IFLA_BRIDGE_MRP_START_TEST_MAX + 1] = {
> > [IFLA_BRIDGE_MRP_START_TEST_UNSPEC] = { .type = NLA_REJECT },
> > [IFLA_BRIDGE_MRP_START_TEST_RING_ID] = { .type = NLA_U32 },
> > - [IFLA_BRIDGE_MRP_START_TEST_INTERVAL] = { .type = NLA_U32 },
> > + [IFLA_BRIDGE_MRP_START_TEST_INTERVAL] = NLA_POLICY_MIN(NLA_U32, 1),
> > [IFLA_BRIDGE_MRP_START_TEST_MAX_MISS] = { .type = NLA_U32 },
> > [IFLA_BRIDGE_MRP_START_TEST_PERIOD] = { .type = NLA_U32 },
> > [IFLA_BRIDGE_MRP_START_TEST_MONITOR] = { .type = NLA_U32 },
> > @@ -316,7 +316,7 @@ static const struct nla_policy
> > br_mrp_start_in_test_policy[IFLA_BRIDGE_MRP_START_IN_TEST_MAX + 1] = {
> > [IFLA_BRIDGE_MRP_START_IN_TEST_UNSPEC] = { .type = NLA_REJECT },
> > [IFLA_BRIDGE_MRP_START_IN_TEST_IN_ID] = { .type = NLA_U32 },
> > - [IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL] = { .type = NLA_U32 },
> > + [IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL] =
> > NLA_POLICY_MIN(NLA_U32, 1),
> > [IFLA_BRIDGE_MRP_START_IN_TEST_MAX_MISS] = { .type = NLA_U32 },
> > [IFLA_BRIDGE_MRP_START_IN_TEST_PERIOD] = { .type = NLA_U32 },
> > };
>
> Alright, let's limit them :-)
>
> Acked-by: Nikolay Aleksandrov <[email protected]>
>
