Received: by 2002:a25:683:0:0:0:0:0 with SMTP id 125csp107063ybg; Mon, 8 Jun 2020 17:47:13 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw191m1Gz3EeGjbfDik8b5quzhRhH9MwluqPU4qXbn9GvysgMBSvu6XBn9HOdlVI4X9Cm5A X-Received: by 2002:a17:906:4f94:: with SMTP id o20mr4588198eju.113.1591663633128; Mon, 08 Jun 2020 17:47:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591663633; cv=none; d=google.com; s=arc-20160816; b=Ja3H5tZcyaSmn1fl0YNB2pQyLAlhyVcSaj/KaIaIv71ZiHEiP44iBs643b2oS0DZuu b1IL/cKTlnb3GejQc6M9J4LpbK8kg6w7NQtZXit/D0a4HHcOAjAAMOnAi6Xaiuw2mf16 H3rF/VlIjRWpSpHycMFSoC+xWEhcKzQU29GuAe/55J7GXt0JO344MzobtRvyW+LcCJQP HK++vLsor6IQ5HL6FDZYb2A9mTax10OcoaJdwCCYeW0U+J87jyoHmRC21JdilXw19RHE YnIw9BxzwOpBEV2CzsHo4aL1fp/BZ3UbNjKdpD3OIiq4kWHRjGRca/GmNSv0hluklxqV A5xA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=4aiMrF5GC1D2L9543109q0XfIavbnUooXsJ/av4aPZM=; b=ejpTx1ry8hoFhlQxG1ZO4XKdOEkB2OGOYIUhm2+7UN9CvGSrm267bRHFW3MLoiQ6sq TFryW19e7zs+pBfrKOh2F80uc8DeUDdeTYlhP6zkdZ3fFerugrkRZQQLf7mW1e0vstpF 4cmZHRTFydzBmMAqKsgawlRo3xavcy4XYfzPEln0e4fTY3momU5LxraiA6384fnNqvaW hk6mpLxKy769+zS7e+XH+xf6mjm/5L7/56l6/Q6oE16rCYilv0TtnBx2DHHjzmFhadC3 EwdtokFqNNSsdvg8JKvi8H0YdDaoRmYCuDgBEWUtaXzIWECmszFr+zIsg8CismqtwSjK J04w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=jRQGwD58; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id c21si9367256ejx.217.2020.06.08.17.46.49; Mon, 08 Jun 2020 17:47:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=jRQGwD58; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731928AbgFIApK (ORCPT + 99 others); Mon, 8 Jun 2020 20:45:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:58944 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729003AbgFHXLx (ORCPT ); Mon, 8 Jun 2020 19:11:53 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5708C208C3; Mon, 8 Jun 2020 23:11:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591657913; bh=0/VpquqGThU+KfpxxkED6oTZqf2JATgh3/hxpS1TVyE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jRQGwD58BEAw8R0E4R4L65iggviXK+ZaO/blXSasPZBnXPveiEVbQf57hRJ/piE7D iIqp4XxHe05xzxibZc6I3T1zut85P2S0DkyA33kQw/+TgoSkj9R/SbzuIbBm7SYA95 KPtvrPpzqMbvRt1f9FeiSIK6a+XJihDdBF41GPhc= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ido Schimmel , Nikolay Aleksandrov , "David S . Miller" , Sasha Levin , netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.7 264/274] vxlan: Avoid infinite loop when suppressing NS messages with invalid options Date: Mon, 8 Jun 2020 19:05:57 -0400 Message-Id: <20200608230607.3361041-264-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200608230607.3361041-1-sashal@kernel.org> References: <20200608230607.3361041-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ido Schimmel [ Upstream commit 8066e6b449e050675df48e7c4b16c29f00507ff0 ] When proxy mode is enabled the vxlan device might reply to Neighbor Solicitation (NS) messages on behalf of remote hosts. In case the NS message includes the "Source link-layer address" option [1], the vxlan device will use the specified address as the link-layer destination address in its reply. To avoid an infinite loop, break out of the options parsing loop when encountering an option with length zero and disregard the NS message. This is consistent with the IPv6 ndisc code and RFC 4886 which states that "Nodes MUST silently discard an ND packet that contains an option with length zero" [2]. [1] https://tools.ietf.org/html/rfc4861#section-4.3 [2] https://tools.ietf.org/html/rfc4861#section-4.6 Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()") Signed-off-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/vxlan.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index a5b415fed11e..779e56c43d27 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1924,6 +1924,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request, ns_olen = request->len - skb_network_offset(request) - sizeof(struct ipv6hdr) - sizeof(*ns); for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) { + if (!ns->opt[i + 1]) { + kfree_skb(reply); + return NULL; + } if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { daddr = ns->opt + i + sizeof(struct nd_opt_hdr); break; -- 2.25.1