netdev - Re: bridge: disable snooping if there is no querier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 6 Aug 2013 11:18:57 -0400
From:	Dave Jones <davej@...hat.com>
To:	netdev@...r.kernel.org
Cc:	Linus Lüssing <linus.luessing@....de>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: bridge: disable snooping if there is no querier

On Sun, Aug 04, 2013 at 12:52:27AM +0000, Linux Kernel wrote:
 > Gitweb:     http://git.kernel.org/linus/;a=commit;h=b00589af3b04736376f24625ab0b394642e89e29
 > Commit:     b00589af3b04736376f24625ab0b394642e89e29
 > Parent:     cf3c4c03060b688cbc389ebc5065ebcce5653e96
 > Author:     Linus Lüssing <linus.luessing@....de>
 > AuthorDate: Thu Aug 1 01:06:20 2013 +0200
 > Committer:  David S. Miller <davem@...emloft.net>
 > CommitDate: Wed Jul 31 17:40:21 2013 -0700
 > 
 >     bridge: disable snooping if there is no querier
 >     
 >     Signed-off-by: Linus Lüssing <linus.luessing@....de>
 >     Signed-off-by: David S. Miller <davem@...emloft.net>
 
 > diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
 > @@ -1198,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
 >  		max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
 >  	}
 >  
 > +	br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
 > +				    max_delay);
 > +
 >  	if (!group)
 >  		goto out;

This addition looks suspect. max_delay looks like it could be uninitialised here.

1178         unsigned long max_delay;

...

1189         if (skb->len == sizeof(*mld)) {
1190                 if (!pskb_may_pull(skb, sizeof(*mld))) {
1191                         err = -EINVAL;
1192                         goto out;
1193                 }
1194                 mld = (struct mld_msg *) icmp6_hdr(skb);
1195                 max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
1196                 if (max_delay)
1197                         group = &mld->mld_mca;
1198         } else if (skb->len >= sizeof(*mld2q)) {
1199                 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
1200                         err = -EINVAL;
1201                         goto out;
1202                 }
1203                 mld2q = (struct mld2_query *)icmp6_hdr(skb);
1204                 if (!mld2q->mld2q_nsrcs)
1205                         group = &mld2q->mld2q_mca;
1206                 max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
1207         }
1208 
1209         br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
1210                                     max_delay);

If skb_len matches neither of those conditions, we don't set it.

Explicitly set it to something on entry ? Or is there validation further up the
callchain that skb_len will only ever be one of these two values ?

	Dave

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html