From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 201A33203B6; Mon, 13 Apr 2026 16:59:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776099579; cv=none; b=tTYldllRn9m5wqoOvMLnA2hlPN0t6YGwxm3kGyGo3YdxXV1HpCMycZ8UrutY5an0freiQrcux7ytRURyjdlpCqFn5zxfdD+psJguQcdL6vYJl8Pbt0DPZL0CWmumRAv5yOHmFan9EfccIOxaxoRWmhjjrGXLAAiEKMEH232CKrs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776099579; c=relaxed/simple; bh=ItitwoIgaiMGD3BRn3Lk0zSdAWuOObPNKcetXBamqX4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XFrMvO9lSYGedSlUg76R1HFboAm6kWYVz4jVAAq7chTh+taDTOxNfgoL3Wr0Zg3s2XhkMofVTrzXiIS7+wfSw6nPE6YZR429PgvOClKjc5l3/Gm80I7VnnLWTGdK2zsNuIXQTY5otKMDI8HOw/Z8kJr+ooygbYfOQj6Zltu8vpQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tRdhQ25A; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tRdhQ25A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F9AFC2BCAF; Mon, 13 Apr 2026 16:59:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776099578; bh=ItitwoIgaiMGD3BRn3Lk0zSdAWuOObPNKcetXBamqX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tRdhQ25An7RIMlt8ABqVV/P7IL9FY//+GApKIHMZ48Bq0g0MYgklP5NG6GvdjQwY8 umPpMGq6pvdzHQPAA2WQsYAqoXto0hcz36caC8fk286F8qzufncw0GJ8Mfx+gRfM1h EeKceh+mP1Q/1kmYLVxjEDyf6GIWnKUWmSBgiN/U= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yifan Wu , Juefei Pu , Ao Zhou , Yuan Tan , Xin Liu , Ido Schimmel , Nikolay Aleksandrov , Jakub Kicinski Subject: [PATCH 5.10 395/491] bridge: br_nd_send: validate ND option lengths Date: Mon, 13 Apr 2026 18:00:40 +0200 Message-ID: <20260413155833.822420855@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155819.042779211@linuxfoundation.org> References: <20260413155819.042779211@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yang Yang commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream. br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_arp_nd_proxy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -285,12 +285,14 @@ static void br_nd_send(struct net_bridge ns_olen = request->len - (skb_network_offset(request) + sizeof(struct ipv6hdr)) - sizeof(*ns); for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) { - if (!ns->opt[i + 1]) { + if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) { kfree_skb(reply); return; } if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { - daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + if ((ns->opt[i + 1] << 3) >= + sizeof(struct nd_opt_hdr) + ETH_ALEN) + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); break; } }