Ido Schimmel
de9d1010b9
bridge: Avoid infinite loop when suppressing NS messages with invalid options ...
[ Upstream commit 53fc685243bd6fb90d90305cea54598b78d3cbfc ]
When neighbor suppression is enabled the bridge device might reply to
Neighbor Solicitation (NS) messages on behalf of remote hosts.
In case the NS message includes the "Source link-layer address" option
[1], the bridge device will use the specified address as the link-layer
destination address in its reply.
To avoid an infinite loop, break out of the options parsing loop when
encountering an option with length zero and disregard the NS message.
This is consistent with the IPv6 ndisc code and RFC 4886 which states
that "Nodes MUST silently discard an ND packet that contains an option
with length zero" [2].
[1] https://tools.ietf.org/html/rfc4861#section-4.3
[2] https://tools.ietf.org/html/rfc4861#section-4.6
Fixes: ed842faeb2
2020-06-17 16:40:20 +02:00
ax25: fix setsockopt(SO_BINDTODEVICE)
2020-06-03 08:20:39 +02:00
batman-adv: Fix refcnt leak in batadv_v_ogm_process
2020-05-14 07:58:28 +02:00
Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
2020-04-13 10:48:13 +02:00
net/bpfilter: remove superfluous testing message
2020-04-21 09:04:53 +02:00
bridge: Avoid infinite loop when suppressing NS messages with invalid options
2020-06-17 16:40:20 +02:00
libceph: ignore pool overlay and cache logic on redirects
2020-06-03 08:21:25 +02:00
__netif_receive_skb_core: pass skb by reference
2020-06-03 08:20:47 +02:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:36:45 +02:00
net: dsa: declare lockless TX feature for slave ports
2020-06-03 08:21:38 +02:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:04:44 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:17:44 +01:00
devinet: fix memleak in inetdev_init()
2020-06-10 20:24:54 +02:00
ipv6: fix IPV6_ADDRFORM operation logic
2020-06-17 16:40:19 +02:00
l2tp: do not use inet_hash()/inet_unhash()
2020-06-10 20:24:54 +02:00
mac80211: mesh: fix discovery timer re-arming issue / crash
2020-06-03 08:21:30 +02:00
netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
2020-06-03 08:21:39 +02:00
netlabel: cope with NULL catmap
2020-05-20 08:20:08 +02:00
netlink: Use netlink header as base to calculate bad attribute offset
2020-03-18 07:17:40 +01:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:33:08 +02:00
nfc: add missing attribute validation for vendor subcommand
2020-03-18 07:17:46 +01:00
net: openvswitch: ovs_ct_exit to be done under ovs_lock
2020-04-29 16:33:08 +02:00
net/packet: tpacket_rcv: avoid a producer race condition
2020-04-01 11:01:35 +02:00
net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
2020-06-03 08:21:00 +02:00
net/rds: Use ERR_PTR for rds_message_alloc_sgs()
2020-05-20 08:20:27 +02:00
rxrpc: Fix ack discard
2020-05-27 17:46:51 +02:00
net_sched: fix tcm_parent in tc filter dump
2020-05-20 08:20:07 +02:00
sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
2020-06-03 08:21:02 +02:00
net/smc: cancel event worker during device removal
2020-03-18 07:17:59 +01:00
SUNRPC: Revert 241b1f419f ("SUNRPC: Remove xdr_buf_trim()")
2020-05-20 08:20:39 +02:00
tipc: block BH before using dst_cache
2020-06-03 08:21:03 +02:00
net/tls: free record only on encryption error
2020-06-03 08:21:06 +02:00
vsock: fix timeout in vsock_accept()
2020-06-10 20:24:55 +02:00
cfg80211: fix debugfs rename crash
2020-06-03 08:21:29 +02:00
net/x25: Fix x25_neigh refcnt leak when receiving frame
2020-04-29 16:33:09 +02:00
xsk: Add overflow check for u64 division, stored into u32
2020-06-03 08:21:36 +02:00
xfrm: fix a NULL-ptr deref in xfrm_local_error
2020-06-03 08:21:33 +02:00
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
2020-04-01 11:02:18 +02:00
de9d1010b9