From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C892B67E; Wed, 8 Apr 2026 18:17:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672263; cv=none; b=E7NUCMZYqE9UdsUeglgaV++IdeDbU9oc1fyeWaFvyAKjIE+u6FM6tmdwj+E0DqPsFGJ0ib9GqBKfeHxqgin7wDgIlMJXplpWKgIoGRRXA17Rx9GbbnxCrMYIMVUmMVSzczAw9LGF+oUl/f7pfT+AXvQ6c+99ivBhbw0a13Giqi8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672263; c=relaxed/simple; bh=9J8jWHQEjxLXjgpLK+8oP9aSks7MR4wEX05Mtq1nuG8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TvgSag75Dx/ow6g2ZefD4tvgDrYwj6TohAVtS752MkJkeibBg09PUEYj9weX/XXLUfypRYcAJnKCGMsTZlNKylYyj6o1OIsJBHVVqxIeOVChFLvW4VTuVPDfK82cWexlWemmHSAM7fJnHGf6uPlkoswGImtjqhekn6gL16G5Lxs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AIB/AF6/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AIB/AF6/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6815C19421; Wed, 8 Apr 2026 18:17:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775672263; bh=9J8jWHQEjxLXjgpLK+8oP9aSks7MR4wEX05Mtq1nuG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AIB/AF6/ASgznfZC+d28OCKLUYCkc0AXB3ewpVw8N+xPepfvyRxehGYSYvZtQGRXN 2yvFYiU/8gtE79CgX8SKYyownMsVpebWIvlhPmYQoTFZXX2CiqKhqB4qD/b4bcRdO5 ibCpfhXF5xMVnP86Oqcl/JJmY4HLzGjMeAzqCD2w= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yifan Wu , Juefei Pu , Ao Zhou , Yuan Tan , Xin Liu , Ido Schimmel , Nikolay Aleksandrov , Jakub Kicinski Subject: [PATCH 6.1 252/312] vxlan: validate ND option lengths in vxlan_na_create Date: Wed, 8 Apr 2026 20:02:49 +0200 Message-ID: <20260408175943.156799327@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260408175933.715315542@linuxfoundation.org> References: <20260408175933.715315542@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yang Yang commit afa9a05e6c4971bd5586f1b304e14d61fb3d9385 upstream. vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-4-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/vxlan/vxlan_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -2009,12 +2009,14 @@ static struct sk_buff *vxlan_na_create(s ns_olen = request->len - skb_network_offset(request) - sizeof(struct ipv6hdr) - sizeof(*ns); for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) { - if (!ns->opt[i + 1]) { + if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) { kfree_skb(reply); return NULL; } if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { - daddr = ns->opt + i + sizeof(struct nd_opt_hdr); + if ((ns->opt[i + 1] << 3) >= + sizeof(struct nd_opt_hdr) + ETH_ALEN) + daddr = ns->opt + i + sizeof(struct nd_opt_hdr); break; } }