mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 17:35:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

bridge: Use ndisc_parse_options() to parse ND options in br_nd_send()

Browse Source 
Replace the manual ND option parsing loop in br_nd_send() with
ndisc_parse_options(), which provides proper validation and avoids the
class of bugs that were fixed by commit 53fc685243 ("bridge: Avoid
infinite loop when suppressing NS messages with invalid options") and
commit 850837965a ("bridge: br_nd_send: validate ND option lengths").

Use ndisc_opt_addr_data() to extract the source link-layer address
from the parsed options, which correctly validates the option length
for the underlying device type.

Export ndisc_parse_options() so that it can be resolved from the bridge
when it is built as a module (CONFIG_BRIDGE=m); otherwise modpost fails
with an undefined symbol.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Link: https://patch.msgid.link/20260803112505.613873-6-danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Danielle Ratson
2026-08-03 14:25:05 +03:00
committed by Jakub Kicinski
parent 67b14d6e36
commit 7445aaa9fe
2 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
net/bridge/br_arp_nd_proxy.c
View File

@@ -255,15 +255,16 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
{
struct net_device *dev = request->dev;
struct net_bridge_vlan_group *vg;
struct ndisc_options ndopts;
struct nd_msg *na, *ns;
struct sk_buff *reply;
struct ipv6hdr *pip6;
int na_olen = 8; /* opt hdr + ETH_ALEN for target */
int ns_olen;
int i, len;
u8 *daddr;
bool dad;
u16 pvid;
int len;
if (!dev)
return;
@@ -284,20 +285,21 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
daddr = eth_hdr(request)->h_source;
ns = (struct nd_msg *)skb_transport_header(request);
/* Do we need option processing ? */
ns_olen = request->len - (skb_network_offset(request) +
sizeof(struct ipv6hdr)) - sizeof(*ns);
for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) {
kfree_skb(reply);
return;
}
if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
if ((ns->opt[i + 1] << 3) >=
sizeof(struct nd_opt_hdr) + ETH_ALEN)
daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
break;
}
/* Derive the option length from the IPv6 payload length so that any
* trailing L2 padding in the skb is not parsed as ND options.
*/
ns_olen = ntohs(ipv6_hdr(request)->payload_len) - sizeof(*ns);
if (!ndisc_parse_options(dev, ns->opt, ns_olen, &ndopts)) {
kfree_skb(reply);
return;
}
if (ndopts.nd_opts_src_lladdr) {
u8 *lladdr;
lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
if (lladdr)
daddr = lladdr;
}
dad = ipv6_addr_any(&ipv6_hdr(request)->saddr);

1
net/ipv6/ndisc.c
View File

@@ -283,6 +283,7 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
}
return ndopts;
}
EXPORT_SYMBOL_GPL(ndisc_parse_options);
int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
{