* Re: bridge: disable snooping if there is no querier
[not found] <20130804005227.D17B3660D03@gitolite.kernel.org>
@ 2013-08-06 15:18 ` Dave Jones
2013-08-06 15:47 ` Eric Dumazet
0 siblings, 1 reply; 2+ messages in thread
From: Dave Jones @ 2013-08-06 15:18 UTC (permalink / raw)
To: netdev; +Cc: Linus Lüssing, David S. Miller
On Sun, Aug 04, 2013 at 12:52:27AM +0000, Linux Kernel wrote:
> Gitweb: http://git.kernel.org/linus/;a=commit;h=b00589af3b04736376f24625ab0b394642e89e29
> Commit: b00589af3b04736376f24625ab0b394642e89e29
> Parent: cf3c4c03060b688cbc389ebc5065ebcce5653e96
> Author: Linus Lüssing <linus.luessing@web.de>
> AuthorDate: Thu Aug 1 01:06:20 2013 +0200
> Committer: David S. Miller <davem@davemloft.net>
> CommitDate: Wed Jul 31 17:40:21 2013 -0700
>
> bridge: disable snooping if there is no querier
>
> Signed-off-by: Linus Lüssing <linus.luessing@web.de>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
> @@ -1198,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
> max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
> }
>
> + br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
> + max_delay);
> +
> if (!group)
> goto out;
This addition looks suspect. max_delay looks like it could be uninitialised here.
1178 unsigned long max_delay;
...
1189 if (skb->len == sizeof(*mld)) {
1190 if (!pskb_may_pull(skb, sizeof(*mld))) {
1191 err = -EINVAL;
1192 goto out;
1193 }
1194 mld = (struct mld_msg *) icmp6_hdr(skb);
1195 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
1196 if (max_delay)
1197 group = &mld->mld_mca;
1198 } else if (skb->len >= sizeof(*mld2q)) {
1199 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
1200 err = -EINVAL;
1201 goto out;
1202 }
1203 mld2q = (struct mld2_query *)icmp6_hdr(skb);
1204 if (!mld2q->mld2q_nsrcs)
1205 group = &mld2q->mld2q_mca;
1206 max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
1207 }
1208
1209 br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
1210 max_delay);
If skb_len matches neither of those conditions, we don't set it.
Explicitly set it to something on entry ? Or is there validation further up the
callchain that skb_len will only ever be one of these two values ?
Dave
^ permalink raw reply [flat|nested] 2+ messages in thread