From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEA1A3537FC; Wed, 8 Apr 2026 18:17:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672240; cv=none; b=D0RGnKPIFvS/MNhCpUazUcAkKFq5ffX0I+9wXMDLI/O7UrL7TqAeeQwVN03HjnmUveOLFTbZx18HVC976saQLl0eV7dRojqUnlITVoUVOL1Ya+jTLKulYR1V3yDnwkP1zih46ojlRspnljk5p+UQXHgsGXHg2NBb/yJZ/jCrTDc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672240; c=relaxed/simple; bh=QqOdRA/WrZ6KCjs7eOCp9KkKVM9ief5PNAWgY0CvSmU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lQm8abJSFkxT7fq5FvU4K3nn+JMjvf/a4ap48iGb1vCLI6tfxAGhmPbqfWztqpPZx8o0NYLhdfNY/TckeIg1kKM8JAhSwKo1h2/B3E0AI4wp5bRVAy/cvS2Fc6Y43FvN57z0TKcajn2t/OOvbq5ighkV8Sp7j2KKsEjaOpf837s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QFtSfNU4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QFtSfNU4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51BABC19421; Wed, 8 Apr 2026 18:17:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775672239; bh=QqOdRA/WrZ6KCjs7eOCp9KkKVM9ief5PNAWgY0CvSmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QFtSfNU4V5V/z0VxWtfpx70gohrx+nliYVaXiXxrT3kCwcV0orwDj5RQRYR3f8LNF bJssbP9WRG5ejoSitylRAKJ1H9HGoQAhE6ZHhnmmX8WTxV98rQ8QGOBie+nycVIXil QzIv0I7I16VfhpVGDsfsg985f26AVKqLY78Wn7ZM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yifan Wu , Juefei Pu , Ao Zhou , Yuan Tan , Xin Liu , Ido Schimmel , Nikolay Aleksandrov , Jakub Kicinski Subject: [PATCH 6.1 244/312] bridge: br_nd_send: validate ND option lengths Date: Wed, 8 Apr 2026 20:02:41 +0200 Message-ID: <20260408175942.862033831@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260408175933.715315542@linuxfoundation.org> References: <20260408175933.715315542@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yang Yang commit 850837965af15707fd3142c1cf3c5bfaf022299b upstream. br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_arp_nd_proxy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -285,12 +285,14 @@ static void br_nd_send(struct net_bridge ns_olen = request->len - (skb_network_offset(request) + sizeof(struct ipv6hdr)) - sizeof(*ns); for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) { - if (!ns->opt[i + 1]) { + if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) { kfree_skb(reply); return; } if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { - daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + if ((ns->opt[i + 1] << 3) >= + sizeof(struct nd_opt_hdr) + ETH_ALEN) + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); break; } }