On Mon, 05 Oct 2026 04:16:29 +0000, [email protected] wrote: > [Severity: High] > Is the skb that br_info_notify() allocates large enough for a message > with only RTEXT_FILTER_CFM_CONFIG set?
Right, this is a real bug. br_get_link_af_size_filtered() never counts the config attributes, so the notification only fit for small configs. I reproduced it: with one MEP and about 32 peer MEPs every config change hits the WARN_ON in br_info_notify() and the notification is lost. v2 adds a patch before this one that counts the config attributes when RTEXT_FILTER_CFM_CONFIG is set. > [Severity: Medium] > What does userspace receive when this request deletes the last MEP? Right, it gets an RTM_NEWLINK with no IFLA_BRIDGE_CFM at all, which can't be told apart from other bridge notifications. v2 sends an empty IFLA_BRIDGE_CFM nest for a bridge with no MEPs, so that case is visible. pw-bot: cr
