Linus Lüssing
2019-Aug-14 18:26 UTC
[Bridge] [PATCH net] ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
On Wed, Aug 14, 2019 at 12:58:58PM -0400, David Miller wrote:> From: Stefano Brivio <sbrivio at redhat.com> > Date: Tue, 13 Aug 2019 00:46:01 +0200 > > > Commit ba5ea614622d ("bridge: simplify ip_mc_check_igmp() and > > ipv6_mc_check_mld() calls") replaces direct calls to pskb_may_pull() > > in br_ipv6_multicast_mld2_report() with calls to ipv6_mc_may_pull(), > > that returns -EINVAL on buffers too short to be valid IPv6 packets, > > while maintaining the previous handling of the return code. > > > > This leads to the direct opposite of the intended effect: if the > > packet is malformed, -EINVAL evaluates as true, and we'll happily > > proceed with the processing. > > > > Return 0 if the packet is too short, in the same way as this was > > fixed for IPv4 by commit 083b78a9ed64 ("ip: fix ip_mc_may_pull() > > return value"). > > > > I don't have a reproducer for this, unlike the one referred to by > > the IPv4 commit, but this is clearly broken. > > > > Fixes: ba5ea614622d ("bridge: simplify ip_mc_check_igmp() and ipv6_mc_check_mld() calls") > > Signed-off-by: Stefano Brivio <sbrivio at redhat.com> > > Applied and queued up for -stable.Urgh, sorry... and thanks for the fix(es), absolutely right...