vxlan: Avoid infinite loop when suppressing NS messages with invalid options
[ Upstream commit5.4-rM2-2.2.x-imx-squashed8066e6b449
] When proxy mode is enabled the vxlan device might reply to Neighbor Solicitation (NS) messages on behalf of remote hosts. In case the NS message includes the "Source link-layer address" option [1], the vxlan device will use the specified address as the link-layer destination address in its reply. To avoid an infinite loop, break out of the options parsing loop when encountering an option with length zero and disregard the NS message. This is consistent with the IPv6 ndisc code and RFC 4886 which states that "Nodes MUST silently discard an ND packet that contains an option with length zero" [2]. [1] https://tools.ietf.org/html/rfc4861#section-4.3 [2] https://tools.ietf.org/html/rfc4861#section-4.6 Fixes:4b29dba9c0
("vxlan: fix nonfunctional neigh_reduce()") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
de9d1010b9
commit
3a577e6220
|
@ -1924,6 +1924,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
|
|||
ns_olen = request->len - skb_network_offset(request) -
|
||||
sizeof(struct ipv6hdr) - sizeof(*ns);
|
||||
for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
|
||||
if (!ns->opt[i + 1]) {
|
||||
kfree_skb(reply);
|
||||
return NULL;
|
||||
}
|
||||
if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
|
||||
daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
|
||||
break;
|
||||
|
|
Loading…
Reference in New Issue