Merge branch 'Fix-infinite-loop-in-bridge-and-vxlan-modules' (d36ceaef) · Commits · 戴 / test

Ido Schimmel says: ==================== Fix infinite loop in bridge and vxlan modules When suppressing invalid IPv6 Neighbour Solicitation messages, it is possible for the bridge and vxlan modules to get stuck in an infinite loop. See the individual changelogs for detailed explanation of the problem and solution. The bug was originally reported against the bridge module, but after auditing the code base I found that the buggy code was copied from the vxlan module. This patch set fixes both modules. Could not find more instances of the problem. Please consider both patches for stable releases. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/vxlan.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -2092,6 +2092,10 @@ static struct sk_buff vxlan_na_create(struct sk_buff request,
		ns_olen = request->len - skb_network_offset(request) -
		sizeof(struct ipv6hdr) - sizeof(*ns);
		for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
		if (!ns->opt[i + 1]) {
		kfree_skb(reply);
		return NULL;
		}
		if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
		daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
		break;

net/bridge/br_arp_nd_proxy.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -276,6 +276,10 @@ static void br_nd_send(struct net_bridge br, struct net_bridge_port p,
		ns_olen = request->len - (skb_network_offset(request) +
		sizeof(struct ipv6hdr)) - sizeof(*ns);
		for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
		if (!ns->opt[i + 1]) {
		kfree_skb(reply);
		return;
		}
		if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
		daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
		break;

Admin message