From: "Linus Lüssing" <linus.luessing@web.de>
To: bridge@lists.linux-foundation.org
Cc: "Paul Bolle" <pebolle@tiscali.nl>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
"Adam Baker" <linux@baker-net.org.uk>,
"Stephen Hemminger" <stephen@networkplumber.org>,
"Linus Lüssing" <linus.luessing@web.de>,
"David S. Miller" <davem@davemloft.net>,
"Cong Wang" <amwang@redhat.com>
Subject: [PATCH] bridge: don't try to update timers in case of broken MLD queries
Date: Tue, 6 Aug 2013 00:32:05 +0200 [thread overview]
Message-ID: <1375741925-22179-1-git-send-email-linus.luessing@web.de> (raw)
Currently we are reading an uninitialized value for the max_delay
variable when snooping an MLD query message of invalid length and would
update our timers with that.
Fixing this by simply ignoring such broken MLD queries (just like we do
for IGMP already).
This is a regression introduced by:
"bridge: disable snooping if there is no querier" (b00589af3b04)
Reported-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
---
net/bridge/br_multicast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 61c5e81..08e576a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1195,7 +1195,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
if (max_delay)
group = &mld->mld_mca;
- } else if (skb->len >= sizeof(*mld2q)) {
+ } else {
if (!pskb_may_pull(skb, sizeof(*mld2q))) {
err = -EINVAL;
goto out;
--
1.7.10.4
next reply other threads:[~2013-08-05 22:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-05 22:32 Linus Lüssing [this message]
2013-08-05 22:42 ` [PATCH] bridge: don't try to update timers in case of broken MLD queries Stephen Hemminger
2013-08-06 0:32 ` Linus Lüssing
2013-08-05 22:44 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1375741925-22179-1-git-send-email-linus.luessing@web.de \
--to=linus.luessing@web.de \
--cc=amwang@redhat.com \
--cc=bridge@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@baker-net.org.uk \
--cc=netdev@vger.kernel.org \
--cc=pebolle@tiscali.nl \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).