syzbot


WARNING in br_multicast_del_pg

Status: upstream: reported on 2026/02/10 03:36
Subsystems: bridge
[Documentation on labels]
Reported-by: syzbot+d5d1b7343531d17bd3c5@syzkaller.appspotmail.com
Fix commit: net: bridge: mcast: always update mdb_n_entries for vlan contexts
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 13d, last: 3d07h
Discussions (4)
Title Replies (including bot) Last reply
[PATCH net v2 1/2] net: bridge: mcast: always update mdb_n_entries for vlan contexts 1 (1) 2026/02/13 07:00
Re: [net,2/2] selftests: forwarding: bridge_mdb_max: add tests for mdb_n_entries warning 1 (1) 2026/02/13 03:04
[PATCH net 1/2] net: bridge: mcast: always update mdb_n_entries for vlan contexts 1 (1) 2026/02/10 14:48
[syzbot] [bridge?] WARNING in br_multicast_del_pg 1 (2) 2026/02/10 06:55

Sample crash report:
------------[ cut here ]------------
n == 0
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#1: syz.0.2145/13675
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#1: syz.0.2145/13675
WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#1: syz.0.2145/13675
Modules linked in:
CPU: 1 UID: 0 PID: 13675 Comm: syz.0.2145 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline]
RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline]
RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825
Code: 41 5f 5d e9 34 cf 37 f7 e8 ff dc 4b f7 90 0f 0b 90 e9 cf fd ff ff e8 f1 dc 4b f7 90 0f 0b 90 e9 16 fd ff ff e8 e3 dc 4b f7 90 <0f> 0b 90 e9 60 fd ff ff e8 d5 dc 4b f7 eb 05 e8 ce dc 4b f7 48 8b
RSP: 0018:ffffc9000cec7220 EFLAGS: 00010287
RAX: ffffffff8a79ab1d RBX: ffff888079bb2800 RCX: 0000000000080000
RDX: ffffc9000d3b2000 RSI: 000000000000035f RDI: 0000000000000360
RBP: 0000000000000000 R08: ffff88802f131e40 R09: 000000000000000c
R10: 000000000000000c R11: 0000000000000002 R12: ffff888076c9cc10
R13: dffffc0000000000 R14: ffff88805a64c1c4 R15: 1ffff1100b4c9838
FS:  00007fde454d56c0(0000) GS:ffff88812556f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c278cf1 CR3: 000000007d054000 CR4: 00000000003526f0
DR0: 0000000000000003 DR1: 00000000000001f8 DR2: 000000000000008e
DR3: 000000000000057a DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline]
 br_mdb_flush net/bridge/br_mdb.c:1544 [inline]
 br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561
 rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1
 rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fde4459bf79
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fde454d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fde44815fa0 RCX: 00007fde4459bf79
RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007fde446327e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fde44816038 R14: 00007fde44815fa0 R15: 00007fde4493fa48
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/15 22:45 upstream bb7a3fc2c976 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce WARNING in br_multicast_del_pg
2026/02/06 03:24 net c89477ad7944 f03c4191 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING in br_multicast_del_pg
* Struck through repros no longer work on HEAD.