Re: bridge: disable snooping if there is no querier

Re: bridge: disable snooping if there is no querier

[Dave Jones]

On Sun, Aug 04, 2013 at 12:52:27AM +0000, Linux Kernel wrote:
 > Gitweb:     http://git.kernel.org/linus/;a=commit;h=b00589af3b04736376f24625ab0b394642e89e29
 > Commit:     b00589af3b04736376f24625ab0b394642e89e29
 > Parent:     cf3c4c03060b688cbc389ebc5065ebcce5653e96
 > Author:     Linus Lüssing <linus.luessing@web.de>
 > AuthorDate: Thu Aug 1 01:06:20 2013 +0200
 > Committer:  David S. Miller <davem@davemloft.net>
 > CommitDate: Wed Jul 31 17:40:21 2013 -0700
 > 
 >     bridge: disable snooping if there is no querier
 >     
 >     Signed-off-by: Linus Lüssing <linus.luessing@web.de>
 >     Signed-off-by: David S. Miller <davem@davemloft.net>
 
 > diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
 > @@ -1198,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
 >  		max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
 >  	}
 >  
 > +	br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
 > +				    max_delay);
 > +
 >  	if (!group)
 >  		goto out;

This addition looks suspect. max_delay looks like it could be uninitialised here.

1178         unsigned long max_delay;

...

1189         if (skb->len == sizeof(*mld)) {
1190                 if (!pskb_may_pull(skb, sizeof(*mld))) {
1191                         err = -EINVAL;
1192                         goto out;
1193                 }
1194                 mld = (struct mld_msg *) icmp6_hdr(skb);
1195                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
1196                 if (max_delay)
1197                         group = &mld->mld_mca;
1198         } else if (skb->len >= sizeof(*mld2q)) {
1199                 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
1200                         err = -EINVAL;
1201                         goto out;
1202                 }
1203                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
1204                 if (!mld2q->mld2q_nsrcs)
1205                         group = &mld2q->mld2q_mca;
1206                 max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
1207         }
1208 
1209         br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
1210                                     max_delay);

If skb_len matches neither of those conditions, we don't set it.

Explicitly set it to something on entry ? Or is there validation further up the
callchain that skb_len will only ever be one of these two values ?

	Dave

Re: bridge: disable snooping if there is no querier

[Eric Dumazet]

On Tue, 2013-08-06 at 11:18 -0400, Dave Jones wrote:
> On Sun, Aug 04, 2013 at 12:52:27AM +0000, Linux Kernel wrote:
>  > Gitweb:     http://git.kernel.org/linus/;a=commit;h=b00589af3b04736376f24625ab0b394642e89e29
>  > Commit:     b00589af3b04736376f24625ab0b394642e89e29
>  > Parent:     cf3c4c03060b688cbc389ebc5065ebcce5653e96
>  > Author:     Linus Lüssing <linus.luessing@web.de>
>  > AuthorDate: Thu Aug 1 01:06:20 2013 +0200
>  > Committer:  David S. Miller <davem@davemloft.net>
>  > CommitDate: Wed Jul 31 17:40:21 2013 -0700
>  > 
>  >     bridge: disable snooping if there is no querier
>  >     
>  >     Signed-off-by: Linus Lüssing <linus.luessing@web.de>
>  >     Signed-off-by: David S. Miller <davem@davemloft.net>
>  
>  > diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
>  > @@ -1198,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
>  >  		max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
>  >  	}
>  >  
>  > +	br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
>  > +				    max_delay);
>  > +
>  >  	if (!group)
>  >  		goto out;
> 
> This addition looks suspect. max_delay looks like it could be uninitialised here.
> 
> 1178         unsigned long max_delay;
> 
> ...

fixed in David net tree