netdev - [PATCH net] ipv6: fix ndisc_is_useropt() handling for PIO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20240729233839.139227-1-maze@google.com>
Date: Mon, 29 Jul 2024 16:38:39 -0700
From: "Maciej Żenczykowski" <maze@...gle.com>
To: "Maciej Żenczykowski" <zenczykowski@...il.com>
Cc: Linux Network Development Mailing List <netdev@...r.kernel.org>, "David S . Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	"Maciej Żenczykowski" <maze@...gle.com>, Jen Linkova <furry@...gle.com>, Lorenzo Colitti <lorenzo@...gle.com>, 
	Patrick Rohr <prohr@...gle.com>, David Ahern <dsahern@...il.com>, 
	"YOSHIFUJI Hideaki / 吉藤英明" <yoshfuji@...ux-ipv6.org>
Subject: [PATCH net] ipv6: fix ndisc_is_useropt() handling for PIO

The current logic only works if the PIO is between two
other ND user options.  This fixes it so that the PIO
can also be either before or after other ND user options
(for example the first or last option in the RA).

side note: there's actually Android tests verifying
a portion of the old broken behaviour, so:
  https://android-review.googlesource.com/c/kernel/tests/+/3196704
fixes those up.

Cc: Jen Linkova <furry@...gle.com>
Cc: Lorenzo Colitti <lorenzo@...gle.com>
Cc: Patrick Rohr <prohr@...gle.com>
Cc: David Ahern <dsahern@...il.com>
Cc: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@...ux-ipv6.org>
Cc: Jakub Kicinski <kuba@...nel.org>
Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
Fixes: 048c796beb6e ("ipv6: adjust ndisc_is_useropt() to also return true for PIO")
---
 net/ipv6/ndisc.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 70a0b2ad6bd7..da939996a4aa 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -197,6 +197,8 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 static inline int ndisc_is_useropt(const struct net_device *dev,
 				   struct nd_opt_hdr *opt)
 {
+	// warning: kernel parsed options like ND_OPT_PREFIX_INFO
+	// also need special casing in ndisc_parse_options()
 	return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 		opt->nd_opt_type == ND_OPT_RDNSS ||
 		opt->nd_opt_type == ND_OPT_DNSSL ||
@@ -227,6 +229,7 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 		return NULL;
 	memset(ndopts, 0, sizeof(*ndopts));
 	while (opt_len) {
+		bool useropt = false;
 		int l;
 		if (opt_len < sizeof(struct nd_opt_hdr))
 			return NULL;
@@ -250,6 +253,7 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 			}
 			break;
 		case ND_OPT_PREFIX_INFO:
+			useropt = true;
 			ndopts->nd_opts_pi_end = nd_opt;
 			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
@@ -263,9 +267,7 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 #endif
 		default:
 			if (ndisc_is_useropt(dev, nd_opt)) {
-				ndopts->nd_useropts_end = nd_opt;
-				if (!ndopts->nd_useropts)
-					ndopts->nd_useropts = nd_opt;
+				useropt = true;
 			} else {
 				/*
 				 * Unknown options must be silently ignored,
@@ -279,6 +281,11 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 					  nd_opt->nd_opt_len);
 			}
 		}
+		if (useropt) {
+			ndopts->nd_useropts_end = nd_opt;
+			if (!ndopts->nd_useropts)
+				ndopts->nd_useropts = nd_opt;
+		}
 next_opt:
 		opt_len -= l;
 		nd_opt = ((void *)nd_opt) + l;
-- 
2.46.0.rc1.232.g9752f9e123-goog