From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D261D3BE169 for ; Fri, 27 Mar 2026 06:37:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774593482; cv=none; b=msE7qZlQghFtGgKfV37bAVLwlu2mU1gL1F+BVPoj2vHXUySWr1xL8AlHXEZT3SnJLIUBE8gJpH9XJ7EwBSsS+jMgwXowPo8dDq0cxcZle3ui50BwcwgWuYX8CrmOZkY3kS9QH3j97GI5RThcxajUlGIhOW9PTKVL6pIiJ7Cm+5U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774593482; c=relaxed/simple; bh=+4LgBG2lPnteLEva5q5EV8krPKKJf5AzHFIuy/FUdK0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=uTf0nsPjz+fxr14GRuHJtpE0KBORlD0FsZ9LR1xeQCW5sP0wi57dgqlP45xDqNfsCFEXfZhjCnVEsOQykT4ND7AS9ldNAD1oCvvtApg005hed08fZBwF6O+QtFRNJ0cBO402555dxjVbBdhjKR0wHNmdMsJE/gGwdu+3/pnOaF0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org; spf=none smtp.mailfrom=blackwall.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b=K1Kw/B1m; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=blackwall.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=blackwall.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=blackwall.org header.i=@blackwall.org header.b="K1Kw/B1m" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-48704db565eso24678685e9.1 for ; Thu, 26 Mar 2026 23:37:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall.org; s=google; t=1774593471; x=1775198271; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=eglRAgY65J6K+hGvowI7XYpmAYRuD59HMwb8erAafGE=; b=K1Kw/B1mww//S1t+6oVki27SFuiGdVD7Xx46jspQmc25Q2e3GnyHKkx3ewuWBnDrT8 jZ4A/gx7ThG5VAfMDl0n3boDTruwj7A7u1qX+f/nQWz5Dy156288nVvvf12JxM2GIJ/D agGmWSMQUKHKHnWCK1Ij385apB+Z0/aw+4aXxNgR733V4l9TLsZLI70x3pL9YpdsQ4ZE u66rcp/7WhI/Un7MC/utmFkyYNfB+Naqp0WRtCFQjTPFjfLp2wXqGAmPdPP8IyWNkzj8 t//09oYfb6oFsLZxcOGVUTKkyHrndmKlAONChNPkAJnJvdmMg49fZ3VAicMZpAeh6vjp vPlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774593471; x=1775198271; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=eglRAgY65J6K+hGvowI7XYpmAYRuD59HMwb8erAafGE=; b=phBvCr7WiDOaysk0yZ9WMY8VFWJC43+clxLxaqK7rRJiNFkuW/VkG+ROZHBY33PSxw NXGJoLopZWA8MnBFuTFUv0p2J78ynd/MXgf0/URRolFpJBINJsSpAK58atkOGW6YEB6n amBPfD2ZVgPJSzpI7sMCbyGzmxzJ/mBcUq+odkMIi5Dn6Woh8NdkRTHD40mxpNB4C0NF zqoCOXWU47i8qvdRUvK7PlsdfaqK21+zoCGuqfzcvzmCZWKW97atsG3W1dAzOhdHlzVI gDYVOKi8EwbU1w5sZ0JLLOxBMdYl8vI9t4gE94gOknNSnDswgh6lUhQ3ama5hyq6If4A Y7Yg== X-Forwarded-Encrypted: i=1; AJvYcCW85NhV5wOe95/0VwQhKibZ50BqNBJr6++3l3WwQrm7oc9q8r4v87qO54njJxJZLe8An6qv7pA9B4Al5x0=@vger.kernel.org X-Gm-Message-State: AOJu0YzaiH4Up9Mi92i0yE5xKr1Xg25hZP51WdSP0QOcloJOVW6QEliM SUAxhRftFHVadn8SiEP1Q4ora4IEdLdtUjdV+3vc1IGEJA0f+RDSWSHxe7U18CD1qR0= X-Gm-Gg: ATEYQzyCe0SZhF1NupI6P2Ou5T64udxw0kjn5K2V+ThPRVCWgnIwqBdfGmMXzPDa5X6 9KjcA6TNY85JSw7Q1LMEM7Afc9ia4sOFBB0HRcenHMOBXDfMmL2txyIuR1PX68IsLSTjI5eq05p 5T+SKlIvoGTcYLWsgQX4iJWSJ9YjsyH3YthKzfhmyXKt4JF8yW8S6RWEbBtNX6ZA+7+ZXwStPf2 SnIf4HY/JXLWBf8Afi1romu5gdiw9G0/QEQ8jYTktjlsjVtvU8g9mb/j/oKknbJN1junAPxaZ39 BscYiEZ/VNWVhgJA/9bN0Nh4GM7ZRA/Z1q27lzOnedmhxVRekSRLLb/raQe0C1zbaOn+4Vfn+yJ r4aui/AzIw/kNkqBxarWLpJhXDZPjPrLBb+xtGyTJaZuwJs27xQ/KvOQrsnqVgMcNLysvTgDhI+ f6Yi1EvKt3axnahdId0HdfTiDuzkNbAMm1kp2ZfQvAG84E3nnjPDxxHw== X-Received: by 2002:a05:600c:8485:b0:487:1fc:14f9 with SMTP id 5b1f17b1804b1-48727d77c8fmr19397525e9.15.1774593470767; Thu, 26 Mar 2026 23:37:50 -0700 (PDT) Received: from [192.168.0.161] (78-154-15-142.ip.btc-net.bg. [78.154.15.142]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48722c9134fsm123324635e9.9.2026.03.26.23.37.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 26 Mar 2026 23:37:50 -0700 (PDT) Message-ID: Date: Fri, 27 Mar 2026 08:37:49 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net 1/3] bridge: br_nd_send: linearize skb before parsing ND options To: Yang Yang , davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, idosch@nvidia.com Cc: andrew+netdev@lunn.ch, horms@kernel.org, florian.fainelli@broadcom.com, roopa@cumulusnetworks.com, dlstevens@us.ibm.com, nb@tipi-net.de, netdev@vger.kernel.org, bridge@lists.linux.dev, linux-kernel@vger.kernel.org, yifanwucs@gmail.com, tomapufckgml@gmail.com, tanyuan98@outlook.com, bird@lzu.edu.cn References: <20260326034441.2037420-1-n05ec@lzu.edu.cn> <20260326034441.2037420-2-n05ec@lzu.edu.cn> Content-Language: en-US From: Nikolay Aleksandrov In-Reply-To: <20260326034441.2037420-2-n05ec@lzu.edu.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 26/03/2026 05:44, Yang Yang wrote: > br_nd_send() parses neighbour discovery options from ns->opt[] and > assumes that these options are in the linear part of request. > > Its callers only guarantee that the ICMPv6 header and target address > are available, so the option area can still be non-linear. Parsing > ns->opt[] in that case can access data past the linear buffer. > > Linearize request before option parsing and derive ns from the linear > network header. > > Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") > Reported-by: Yifan Wu > Reported-by: Juefei Pu > Tested-by: Ao Zhou > Co-developed-by: Yuan Tan > Signed-off-by: Yuan Tan > Suggested-by: Xin Liu > Signed-off-by: Yang Yang > --- > net/bridge/br_arp_nd_proxy.c | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > > diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c > index 1e2b51769eec8..af3d1e33f50b8 100644 > --- a/net/bridge/br_arp_nd_proxy.c > +++ b/net/bridge/br_arp_nd_proxy.c > @@ -251,12 +251,12 @@ struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb, struct nd_msg *msg) > > static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, > struct sk_buff *request, struct neighbour *n, > - __be16 vlan_proto, u16 vlan_tci, struct nd_msg *ns) > + __be16 vlan_proto, u16 vlan_tci) > { > struct net_device *dev = request->dev; > struct net_bridge_vlan_group *vg; > + struct nd_msg *na, *ns; > struct sk_buff *reply; > - struct nd_msg *na; > struct ipv6hdr *pip6; > int na_olen = 8; /* opt hdr + ETH_ALEN for target */ > int ns_olen; > @@ -264,7 +264,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, > u8 *daddr; > u16 pvid; > > - if (!dev) > + if (!dev || skb_linearize(request)) > return; > > len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) + > @@ -281,6 +281,8 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, > skb_set_mac_header(reply, 0); > > daddr = eth_hdr(request)->h_source; > + ns = (struct nd_msg *)(skb_network_header(request) + > + sizeof(struct ipv6hdr)); > > /* Do we need option processing ? */ > ns_olen = request->len - (skb_network_offset(request) + > @@ -472,9 +474,9 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, > if (vid != 0) > br_nd_send(br, p, skb, n, > skb->vlan_proto, > - skb_vlan_tag_get(skb), msg); > + skb_vlan_tag_get(skb)); > else > - br_nd_send(br, p, skb, n, 0, 0, msg); > + br_nd_send(br, p, skb, n, 0, 0); > replied = true; > } > Acked-by: Nikolay Aleksandrov