mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 01:43:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

bridge: Linearize skb once the ND message type is validated

Browse Source 
br_nd_send() parses ND options from ns->opt[] and therefore needs the skb
to be linear. Commit a01aee7caf ("bridge: br_nd_send: linearize skb
before parsing ND options") ensured that by linearizing inside
br_nd_send() itself.

Move the linearization up into br_is_nd_neigh_msg(), right after
ndisc_check_ns_na() has validated the message as an NS/NA. This makes a
linear buffer a property of every recognized ND message, so that this and
any future ND message handling operate on a linear skb and cannot
reintroduce that class of bug by forgetting to linearize.

Since the skb is now linear by the time br_nd_send() runs, drop the
linearization there and derive ns from the transport header set by
ndisc_check_ns_na(), instead of recomputing it from the network header.

If linearization fails under memory pressure, br_is_nd_neigh_msg() returns
NULL and the packet falls back to normal forwarding rather than being
suppressed.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260803112505.613873-5-danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Danielle Ratson
2026-08-03 14:25:04 +03:00
committed by Jakub Kicinski
parent 18668f4747
commit 67b14d6e36
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
net/bridge/br_arp_nd_proxy.c
View File

@@ -235,11 +235,17 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
#endif
#if IS_ENABLED(CONFIG_IPV6)
/* Validate skb as an NS/NA and linearize it for br_nd_send()'s ND
* option parsing; returns the nd_msg, or NULL on failure.
*/
struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb)
{
if (ndisc_check_ns_na(skb))
return NULL;
if (skb_linearize(skb))
return NULL;
return (struct nd_msg *)skb_transport_header(skb);
}
@@ -259,7 +265,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
bool dad;
u16 pvid;
if (!dev || skb_linearize(request))
if (!dev)
return;
len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
@@ -276,8 +282,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
skb_set_mac_header(reply, 0);
daddr = eth_hdr(request)->h_source;
ns = (struct nd_msg *)(skb_network_header(request) +
sizeof(struct ipv6hdr));
ns = (struct nd_msg *)skb_transport_header(request);
/* Do we need option processing ? */
ns_olen = request->len - (skb_network_offset(request) +