CVE-2026-99117: net: bridge: mcast: don't truncate the port group walk on teardown

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: don't truncate the port group walk on teardown

brmulticastdisableportctx() and brmulticastdelport() walk port->mglist with hlistforeachentrysafe(). However, brmulticastfinddelpg() can also delete other entries from the same list through brmulticastfwdsrcremove() or fwddelstarexcl().

If such an entry is the iterator's saved next node, hlistdelinit() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after delnbp() frees the port:

BUG: KASAN: slab-use-after-free in mdbfillinfo+0x1191/0x1320 mdbfillinfo+0x1191/0x1320 brmdbdump+0x594/0xe40 rtnlmdbdump+0x1cf/0x5d0

Use hlistdelinitrcu() to unlink the group while preserving ->next. brmulticastdelpg() and the teardown walks run under br->multicastlock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer.

Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so brmulticastfinddelpg() would fall through its port scan and hit the trailing WARNON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlistunhashed() identifies exactly this case.