On Mon, Jun 08, 2020 at 07:05:57PM -0400, Sasha Levin wrote:
From: Ido Schimmel idosch@mellanox.com
[ Upstream commit 8066e6b449e050675df48e7c4b16c29f00507ff0 ]
Hi,
In the same patch set I also included a similar fix for the bridge module: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
But I don't see it in the patch sets you sent.
Don't see it here as well: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree... https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=linu...
Did it get lost or it's just pending somewhere else?
Thanks
When proxy mode is enabled the vxlan device might reply to Neighbor Solicitation (NS) messages on behalf of remote hosts.
In case the NS message includes the "Source link-layer address" option [1], the vxlan device will use the specified address as the link-layer destination address in its reply.
To avoid an infinite loop, break out of the options parsing loop when encountering an option with length zero and disregard the NS message.
This is consistent with the IPv6 ndisc code and RFC 4886 which states that "Nodes MUST silently discard an ND packet that contains an option with length zero" [2].
[1] https://tools.ietf.org/html/rfc4861#section-4.3 [2] https://tools.ietf.org/html/rfc4861#section-4.6
Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()") Signed-off-by: Ido Schimmel idosch@mellanox.com Acked-by: Nikolay Aleksandrov nikolay@cumulusnetworks.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org
drivers/net/vxlan.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index a5b415fed11e..779e56c43d27 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1924,6 +1924,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request, ns_olen = request->len - skb_network_offset(request) - sizeof(struct ipv6hdr) - sizeof(*ns); for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
if (!ns->opt[i + 1]) {kfree_skb(reply);return NULL;}-- 2.25.1