From patchwork Sun Mar 27 06:27:24 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Linus_L=C3=BCssing?= X-Patchwork-Id: 88493 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 186C0B6FAC for ; Sun, 27 Mar 2011 17:28:01 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752015Ab1C0G1w (ORCPT ); Sun, 27 Mar 2011 02:27:52 -0400 Received: from fmmailgate02.web.de ([217.72.192.227]:50419 "EHLO fmmailgate02.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751373Ab1C0G1g (ORCPT ); Sun, 27 Mar 2011 02:27:36 -0400 Received: from smtp01.web.de ( [172.20.0.243]) by fmmailgate02.web.de (Postfix) with ESMTP id D708119B21495; Sun, 27 Mar 2011 08:27:35 +0200 (CEST) Received: from [46.126.246.98] (helo=localhost) by smtp01.web.de with asmtp (TLSv1:AES128-SHA:128) (WEB.DE 4.110 #2) id 1Q3jRn-0000Su-00; Sun, 27 Mar 2011 08:27:35 +0200 From: =?UTF-8?q?Linus=20L=C3=BCssing?= To: bridge@lists.linux-foundation.org Cc: Stephen Hemminger , David Miller , YOSHIFUJI Hideaki , Herbert Xu , netdev@vger.kernel.org, =?utf-8?q?Linus=20L=C3=BCssing?= Subject: [PATCH] bridge: mcast snooping, fix length check of snooped MLDv1/2 Date: Sun, 27 Mar 2011 08:27:24 +0200 Message-Id: <1301207244-10428-3-git-send-email-linus.luessing@web.de> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1301207244-10428-1-git-send-email-linus.luessing@web.de> References: <20110327034404.GC31916@Sellars> <1301207244-10428-1-git-send-email-linus.luessing@web.de> MIME-Version: 1.0 X-Sender: linus.luessing@web.de X-Provags-ID: V01U2FsdGVkX19G0LcfdbV1jRj7n0Ha0gA0DYI7prJ2Blu1c53V kIFsIc2FtXYGgY1LjJDco1a00JgLSMgkdX05drSnM9Vr5WwCc5 YcnmTamgBt27H8m3VHaA== Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org "len = ntohs(ip6h->payload_len)" does not include the length of the ipv6 header itself, which the rest of this function assumes, though. This leads to a length check less restrictive as it should be in the following line for one thing. For another, it very likely leads to an integer underrun when substracting the offset and therefore to a very high new value of 'len' due to its unsignedness. This will ultimately lead to the pskb_trim_rcsum() practically never being called, even in the cases where it should. Signed-off-by: Linus Lüssing --- net/bridge/br_multicast.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index 47fae4f..3793264 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, ip6h->payload_len == 0) return 0; - len = ntohs(ip6h->payload_len); + len = ntohs(ip6h->payload_len) + sizeof(*ip6h); if (skb->len < len) return -EINVAL;