From: Ido Schimmel <idosch@idosch.org>
To: Sasha Levin <sashal@kernel.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Ido Schimmel <idosch@mellanox.com>,
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
"David S . Miller" <davem@davemloft.net>,
netdev@vger.kernel.org
Subject: Re: [PATCH AUTOSEL 5.7 264/274] vxlan: Avoid infinite loop when suppressing NS messages with invalid options
Date: Tue, 9 Jun 2020 09:55:48 +0300 [thread overview]
Message-ID: <20200609065548.GA2113611@splinter> (raw)
In-Reply-To: <20200608230607.3361041-264-sashal@kernel.org>
On Mon, Jun 08, 2020 at 07:05:57PM -0400, Sasha Levin wrote:
> From: Ido Schimmel <idosch@mellanox.com>
>
> [ Upstream commit 8066e6b449e050675df48e7c4b16c29f00507ff0 ]
Hi,
In the same patch set I also included a similar fix for the bridge
module:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=53fc685243bd6fb90d90305cea54598b78d3cbfc
But I don't see it in the patch sets you sent.
Don't see it here as well:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.7
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=linux-5.7.y
Did it get lost or it's just pending somewhere else?
Thanks
>
> When proxy mode is enabled the vxlan device might reply to Neighbor
> Solicitation (NS) messages on behalf of remote hosts.
>
> In case the NS message includes the "Source link-layer address" option
> [1], the vxlan device will use the specified address as the link-layer
> destination address in its reply.
>
> To avoid an infinite loop, break out of the options parsing loop when
> encountering an option with length zero and disregard the NS message.
>
> This is consistent with the IPv6 ndisc code and RFC 4886 which states
> that "Nodes MUST silently discard an ND packet that contains an option
> with length zero" [2].
>
> [1] https://tools.ietf.org/html/rfc4861#section-4.3
> [2] https://tools.ietf.org/html/rfc4861#section-4.6
>
> Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()")
> Signed-off-by: Ido Schimmel <idosch@mellanox.com>
> Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/net/vxlan.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
> index a5b415fed11e..779e56c43d27 100644
> --- a/drivers/net/vxlan.c
> +++ b/drivers/net/vxlan.c
> @@ -1924,6 +1924,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
> ns_olen = request->len - skb_network_offset(request) -
> sizeof(struct ipv6hdr) - sizeof(*ns);
> for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
> + if (!ns->opt[i + 1]) {
> + kfree_skb(reply);
> + return NULL;
> + }
> if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
> daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
> break;
> --
> 2.25.1
>
next prev parent reply other threads:[~2020-06-09 6:55 UTC|newest]
Thread overview: 105+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200608230607.3361041-1-sashal@kernel.org>
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 002/274] ath10k: Fix the race condition in firmware dump work queue Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 003/274] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 004/274] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 005/274] ath9k: Fix use-after-free Read in htc_connect_service Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 010/274] igc: Fix default MAC address filter override Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 021/274] net: ethernet: ti: fix return value check in k3_cppi_desc_pool_create_name() Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 023/274] selftests/bpf: Copy runqslower to OUTPUT directory Sasha Levin
2020-06-08 23:01 ` [PATCH AUTOSEL 5.7 024/274] libbpf: Fix memory leak and possible double-free in hashmap__clear Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 028/274] net: atlantic: make hw_get_regs optional Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 029/274] net: ena: fix error returning in ena_com_get_hash_function() Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 031/274] ath10k: remove the max_sched_scan_reqs value Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 035/274] rtw88: fix an issue about leak system resources Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 044/274] mt76: mt7615: fix aid configuration in mt7615_mcu_wtbl_generic_tlv Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 048/274] ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 054/274] Bluetooth: Add SCO fallback for invalid LMP parameters error Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 058/274] ath11k: Fix some resource leaks in error path in 'ath11k_thermal_register()' Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 071/274] batman-adv: Revert "disable ethtool link speed detection when auto negotiation off" Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 073/274] ice: Fix memory leak Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 074/274] ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 075/274] ice: Change number of XDP TxQ to 0 when destroying rings Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 081/274] ice: fix PCI device serial number to be lowercase values Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 083/274] net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.7 084/274] tun: correct header offsets in napi frags mode Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 089/274] ath11k: fix error message to correctly report the command that failed Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 091/274] ath11k: Avoid mgmt tx count underflow Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 092/274] ath10k: fix kernel null pointer dereference Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 093/274] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 094/274] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 099/274] brcmfmac: fix wrong location to get firmware feature Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 102/274] e1000: Distribute switch variables for initialization Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 103/274] net: mscc: ocelot: deal with problematic MAC_ETYPE VCAP IS2 rules Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 113/274] ath10k: add flush tx packets for SDIO chip Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 120/274] dpaa2-eth: fix return codes used in ndo_setup_tc Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 122/274] net/mlx4_core: Add missing iounmap() in error path Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 123/274] bpf, riscv: Fix tail call count off by one in RV32 BPF JIT Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 124/274] netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 125/274] ath11k: use GFP_ATOMIC under spin lock Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 126/274] Bluetooth: Adding driver and quirk defs for multi-role LE Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 128/274] libbpf: Refactor map creation logic and fix cleanup leak Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 129/274] selftests/bpf: Ensure test flavors use correct skeletons Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 130/274] selftests/bpf: Fix memory leak in test selector Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 131/274] selftests/bpf: Fix memory leak in extract_build_id() Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 132/274] selftests/bpf: Fix invalid memory reads in core_relo selftest Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 133/274] libbpf: Fix huge memory leak in libbpf_find_vmlinux_btf_id() Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 134/274] selftests/bpf: Fix bpf_link leak in ns_current_pid_tgid selftest Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 135/274] selftests/bpf: Add runqslower binary to .gitignore Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 139/274] net: bcmgenet: set Rx mode before starting netif Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 140/274] net: bcmgenet: Fix WoL with password after deep sleep Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 142/274] net/mlx5e: CT: Avoid false warning about rule may be used uninitialized Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.7 146/274] stmmac: intel: Fix clock handling on error and remove paths Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 150/274] octeontx2-pf: Fix error return code in otx2_probe() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 151/274] ice: Fix error return code in ice_add_prof() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 152/274] net: lpc-enet: fix error return code in lpc_mii_init() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 154/274] drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 156/274] ath10k: fix possible memory leak in ath10k_bmi_lz_data_large() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 157/274] ath11k: fix error return code in ath11k_dp_alloc() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 160/274] net: allwinner: Fix use correct return type for ndo_start_xmit() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 162/274] ath11k: fix kernel panic by freeing the msdu received with invalid length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 163/274] ath9k_htc: Silence undersized packet warnings Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 164/274] libertas_tf: avoid a null dereference in pointer priv Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 168/274] dsa: sja1105: dynamically allocate stats structure Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 179/274] iwlwifi: avoid debug max amsdu config overwriting itself Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 184/274] ath10k: Skip handling del_server during driver exit Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 185/274] ath10k: Remove msdu from idr when management pkt send fails Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 186/274] wcn36xx: Fix error handling path in 'wcn36xx_probe()' Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 187/274] net: qed*: Reduce RX and TX default ring count when running inside kdump kernel Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 190/274] mt76: mt7663: fix mt7615_mac_cca_stats_reset routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 191/274] mt76: mt7615: do not always reset the dfs state setting the channel Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 192/274] mt76: mt7622: fix DMA unmap length Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 193/274] mt76: mt7663: " Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 194/274] mt76: mt7615: fix mt7615_firmware_own for mt7663e Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 195/274] mt76: mt7615: fix mt7615_driver_own routine Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 196/274] mt76: avoid rx reorder buffer overflow Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 197/274] selftests/bpf: Install generated test progs Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 198/274] brcmfmac: fix WPA/WPA2-PSK 4-way handshake offload and SAE offload failures Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 201/274] net: dsa: mt7530: set CPU port to fallback mode Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.7 204/274] veth: Adjust hard_start offset on redirect XDP frames Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 207/274] net/mlx5e: IPoIB, Drop multicast packets that this interface sent Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 208/274] selftests/bpf: Fix test_align verifier log patterns Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 209/274] net: ipa: do not clear interrupt in gsi_channel_start() Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 210/274] rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 211/274] mwifiex: Fix memory corruption in dump_station Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 217/274] ice: cleanup vf_id signedness Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 218/274] ice: Fix resource leak on early exit from function Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 225/274] selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 226/274] selftests/bpf: CONFIG_LIRC required for test_lirc_mode2.sh Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 227/274] ice: Fix Tx timeout when link is toggled on a VF's interface Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 235/274] net: ethernet: fec: move GPR register offset and bit into DT Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 238/274] macvlan: Skip loopback packets in RX handler Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 251/274] ice: fix potential double free in probe unrolling Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 252/274] ixgbe: fix signed-integer-overflow warning Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 253/274] iwlwifi: mvm: fix aux station leak Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 260/274] ice: Fix inability to set channels when down Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 264/274] vxlan: Avoid infinite loop when suppressing NS messages with invalid options Sasha Levin
2020-06-09 6:55 ` Ido Schimmel [this message]
2020-06-17 16:28 ` Sasha Levin
2020-06-17 17:29 ` Ido Schimmel
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 265/274] libbpf: Fix perf_buffer__free() API for sparse allocs Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.7 266/274] bpf: Fix map permissions check Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 267/274] bpf: Refactor sockmap redirect code so its easy to reuse Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 268/274] bpf: Fix running sk_skb program types with ktls Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 269/274] selftests/bpf, flow_dissector: Close TAP device FD after the test Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 270/274] bpf: Fix up bpf_skb_adjust_room helper's skb csum setting Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 271/274] s390/bpf: Maintain 8-byte stack alignment Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.7 272/274] net_failover: fixed rollback in net_failover_open() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200609065548.GA2113611@splinter \
--to=idosch@idosch.org \
--cc=davem@davemloft.net \
--cc=idosch@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nikolay@cumulusnetworks.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).