From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1F0E331A44; Wed, 8 Apr 2026 18:36:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775673387; cv=none; b=Md7N3bQGuIUzIZc+7pP2GVCI4J2c3dM59nmLLPqMLsXGVI/zhk80oq+QHkcGu0Wei7eApWfz7FPu49cxJx6nZoovhlc8QVshZ/JfV4hsowJIcAHi7MJYW3eT7OjebHz+Rp/RGpnUDsfkCKif7N+fuosMDi1/pQhp2F4Zgvembzc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775673387; c=relaxed/simple; bh=+cij3NoWodzxIn2gKr2iO8+d6crbqT+TXspRB4pj9jk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h6F0c/A9yA0ttfItxqE4O0FL/0xuesjnKFgdptBW3/0mksQeimAJXbQrKtuzwePA3RsN/CzWQx5Jfo+CG6VahQAzw47HtJsAB0ch11fbxPSe6nYd3R9bPHIfgcX/3Xveh+F/St/nnUvyjMJXNMM4YCLUx9FnUyqnHOX30g+MOkM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Mz5b7SA3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Mz5b7SA3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF06DC19421; Wed, 8 Apr 2026 18:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775673387; bh=+cij3NoWodzxIn2gKr2iO8+d6crbqT+TXspRB4pj9jk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mz5b7SA3NS68TU4wLN5Sk2Tvy8V9umrPYAl+f0hIDPtZ/H87pE2bmFToivKtMfXsm ICg2G+Z/Xj0s0DR2eaAcydFJ5ia8HGggO6X/X9iL86pogbKUSFhSXdlRgq/Vl/K2KW AFNKZkyY710PXmbU2nU570J0GmDLDNEM3dD0Z0GA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yifan Wu , Juefei Pu , Ao Zhou , Yuan Tan , Xin Liu , Ido Schimmel , Nikolay Aleksandrov , Jakub Kicinski Subject: [PATCH 6.18 211/277] bridge: br_nd_send: validate ND option lengths Date: Wed, 8 Apr 2026 20:03:16 +0200 Message-ID: <20260408175941.741535960@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260408175933.836769063@linuxfoundation.org> References: <20260408175933.836769063@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yang Yang commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream. br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_arp_nd_proxy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -288,12 +288,14 @@ static void br_nd_send(struct net_bridge ns_olen = request->len - (skb_network_offset(request) + sizeof(struct ipv6hdr)) - sizeof(*ns); for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) { - if (!ns->opt[i + 1]) { + if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) { kfree_skb(reply); return; } if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { - daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + if ((ns->opt[i + 1] << 3) >= + sizeof(struct nd_opt_hdr) + ETH_ALEN) + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); break; } }