From nobody Sat Jul 25 03:45:46 2026 Received: from BN8PR05CU002.outbound.protection.outlook.com (mail-eastus2azon11011019.outbound.protection.outlook.com [52.101.57.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5046D2773E4; Sun, 19 Jul 2026 13:35:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.57.19 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468139; cv=fail; b=OTaEOSNxSO8Od4JCm5vmO7Oq84sbN9CIh0jlgGo+uyHNGoHrH88Ao/V/fJRX4PVdALMBdJfdlMSFLnAJLvP7vEyh0OpIrQJXbWJ7YIcAd3zZn+f0ikBuRa/mHtfGjnODJJCRwe6ttofpigarehC1oBrGormxpkqa1cBk+PgzSfY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468139; c=relaxed/simple; bh=wAj7kqhnVnZX5uQqfa5BjR+usphdXfc3D87KO0HJ/xM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=guj/HZubimErNbtFJnMz/cf0+j4SwBXrQkJzy9Dp0khqG4FAmMowbo6rifezkVmtFawUBvQ3rsB0t6sWk+j429ZXBLrk88QWbb/0LD2pGwu2/1hj5sTrbUgjZ7epXK1dV55C0Wr3FnGCkXDkKCuFd4WUsjpF3GT7wKpxquMh8ss= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=aj0KDEaI; arc=fail smtp.client-ip=52.101.57.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="aj0KDEaI" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=t7WfGxgO2su5RL9xCcOy6doZyQyMh/kOTM0KBVK4tcZYfEBd8q+cV6CG2kjzC4QuCRmzuLMgeTssPeNEV72Fw5AccTnJ/2u42Q6dBtco7wlCoFN78C8NCsGU84oAbXSdkM1T4wcaVYpVmKZUmoB+nUiUbvARIRj/vN1aRj7T0KjXjMnZ8JVcFLuTIv7kbLYSARbmKYHxBV/pxTUiGutAepU9B1b/+LCgsR5Tlh4IPijtJpPyFe+WcLh+/IOvGtFrq8YpGom4CdGd9SEogip8Mv9/geN7JKZoLl1zPu7KTtOglbiTn74Qpb8kaABrB51FNrWCjN1AHvYAVpT3iBBByg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vco+rl/Q7CE9zaX0iCacf3e1PYO3Z++FbWcalzMAQec=; b=vg50hNCiQVUANQu5FEFjKqUAjZH1AWXOWji6JsCMMF5qU/sNICYk0PLfebNjOGCuDpo8UZUzLr+UZ2qo6f3HbCJ4xz+fUCjcdsD6OVea5aXcTJy9w5+FZIsr8XIttqMxXmwHH2AsfD/pwBpIMv9on4mGqIpuXcMa/kopkRx3orDIb8e6nXMF1kJqFchINQYyCjYFBo0Pbfh/kNypCuY5enQWSVd3Tq7Xv4c64OR2CCA8pqhfoW2andcn5kdnTZKOqQF93Vm3AkfDNfrRmpZZH+LzMP8xmKDuA9RRYTYEVs7teWXY4c9ZMZ469KyyWYvk591wbGute0FsXG2JYS8KQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vco+rl/Q7CE9zaX0iCacf3e1PYO3Z++FbWcalzMAQec=; b=aj0KDEaIj3Og5+Qix/ZPduRU3A/zR1IV1hQ1VNgamj4Io677vCi7L9jv/5lyhd9F/2M9+0+vJSEiC4UMpHbjCw2mqLd0JwVwpNLzjxurD/V/NkQY0PwDEpOgTZ1jC5L8zWCHD9ezXaADTS5mr4G6CweZZgQgd8mDAdhB/hcW3cZYyMPs4NKx2pSCfudMasnG/SMLPeg/9bOGxgAB3oBrDClZDdf2Xw5NDbIsi0d81HYdzf/Fke/DmH4AkNRzHYT8a9i20/Ist17CN1Flg8U/RkVp6kACaP+w0DL8mcrvKhUTsmmr8tiLdwjyK8mS5kwhfO8yemZAmRJmQOxXv5z8tg== Received: from CH0PR04CA0095.namprd04.prod.outlook.com (2603:10b6:610:75::10) by DS5PPF016FC81DF.namprd12.prod.outlook.com (2603:10b6:f:fc00::644) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.16; Sun, 19 Jul 2026 13:35:33 +0000 Received: from DS3PEPF000099DF.namprd04.prod.outlook.com (2603:10b6:610:75:cafe::1b) by CH0PR04CA0095.outlook.office365.com (2603:10b6:610:75::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 13:35:32 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by DS3PEPF000099DF.mail.protection.outlook.com (10.167.17.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 13:35:32 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Sun, 19 Jul 2026 06:35:18 -0700 Received: from dev-r-vrt-155.mtr.labs.mlnx (10.126.230.37) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:14 -0700 From: Danielle Ratson To: CC: , , , , , , , , , , , , , , Danielle Ratson Subject: [PATCH net-next 1/5] bridge: Use direct pointer in br_is_nd_neigh_msg() Date: Sun, 19 Jul 2026 16:34:51 +0300 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DS3PEPF000099DF:EE_|DS5PPF016FC81DF:EE_ X-MS-Office365-Filtering-Correlation-Id: 2fc07b9b-ec56-4e32-cdf9-08dee59a9b65 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|1800799024|23010399003|7416014|376014|18002099003|22082099003|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: K3x8FB5OvOSOcwGeX8PmoH9lY+DelCtod8oHljKeiYajStNWUxOkzgInmZ/z0sE5L238jtsOsC+wxwq8teeC0EBV8yNTBxnH/Q/Gfhta3SHisbQtNWzKqiHxThXYKcN5QLO5b3yTUsJF9sFbm6HWlxnEV4J4kutg1Zq8xEuTl5umqh14ICPwWpKUva2B0dL/xMbURR4KauiLUMD6A7UUGdhKTCLmYmhpKCGCHplOCWDZU7HAgQBQrKguzGXjwybixWYihwM3q2pc31UgtIvAYeJL26Y/+RO4RJcI419XweTEdGR9Yk/j4GY06QMd91iuAPJVSPfvGfo8vJrvWa+lZNUco3tl/fFOyBNRCdKUay0hQrhvXEzIQHSNZrjmjJziNiaMxrH8RJlNIawG7VIBliTfrsXF1+0/V0WjAZwZXVJ9d8Svx6RQ3C0jCoiQYDv6vHTdkp/Kr7kRTntT5eeN7Y1CjB++sWflWZieGGp5XeZ1HfHvPz2laZmekWa5wIit3pudTIMhNG89YoXPtvkBBXAbYwrX1/g+t3eWxV/pNLvHVHggqQ0cCRYssu/uNLnjBu7ASAlLmaWs4YaJpFTiP36Q3aEMBLC5/sGzMzcG2WFBK9pM8wkjesRVCH2zNqtEquoqEOkSnqIEq+q+49+EeLslpim15XzIy3g++ZTJEL5Qd3q1byyR7NgPiGBsBBb+B2Q10btD2ULHSYqE6IELUw== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(1800799024)(23010399003)(7416014)(376014)(18002099003)(22082099003)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: SWCIGy0zT/jlMksGKyi66lXQ566DXmWjJOPlsKVghoB6NfQnvuQJEe/9EROXBRskJB9s/H9oCNxH5vQUiLLs3FWMH9quwjiv3dB0dOoecdcBOkYthu6uNJnxYE65oQu8WYQz+IwghoPjxCc4iRsHvxkLIWosJTLe99lFCLH3yAhsuk0Vq69Hyw3XI+Oh1GubuxUdnhLEbpLwFIbM2b5Qlt019yJ3VNmYXTXXP6m7LDx/qzPmlMWlW5qeZFizqp85wYM3EBIQZ3705Zc+2uVyeoheMGcNWDaXR3HjY5NYVk638l4QjdXdwAsm7bdfTB86TWbbIvNjprFgqRFda+gCn3I3S+tQvpVla0lr+wU9LvLDxcpAUlY6WaPaUdV7SOnQXiP3GDSVeyd46Ggdju/F7HAepQaCsObmxTUbCICO8F/4uQppPBMpv1su7XDmgmR6 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2026 13:35:32.6354 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2fc07b9b-ec56-4e32-cdf9-08dee59a9b65 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DS3PEPF000099DF.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS5PPF016FC81DF Content-Type: text/plain; charset="utf-8" Both callers of br_is_nd_neigh_msg() already call pskb_may_pull() to ensure sizeof(struct ipv6hdr) + sizeof(struct nd_msg) bytes are in the linear area before invoking this function. The skb_header_pointer() call and its fallback buffer are therefore unnecessary. Replace skb_header_pointer() with a direct cast to ipv6_hdr(skb) + 1 and drop the now-unused 'msg' parameter and its corresponding stack buffer from all callers. Reviewed-by: Petr Machata Signed-off-by: Danielle Ratson Acked-by: Nikolay Aleksandrov --- net/bridge/br_arp_nd_proxy.c | 9 ++------- net/bridge/br_device.c | 4 ++-- net/bridge/br_input.c | 4 ++-- net/bridge/br_private.h | 2 +- 4 files changed, 7 insertions(+), 12 deletions(-) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index 23eb6931a2b4..db08c3272001 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -234,14 +234,9 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, str= uct net_bridge *br, #endif =20 #if IS_ENABLED(CONFIG_IPV6) -struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb, struct nd_msg= *msg) +struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb) { - struct nd_msg *m; - - m =3D skb_header_pointer(skb, skb_network_offset(skb) + - sizeof(struct ipv6hdr), sizeof(*msg), msg); - if (!m) - return NULL; + struct nd_msg *m =3D (struct nd_msg *)(ipv6_hdr(skb) + 1); =20 if (m->icmph.icmp6_code !=3D 0 || (m->icmph.icmp6_type !=3D NDISC_NEIGHBOUR_SOLICITATION && diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index e7f343ab22d3..ff55dab73632 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -80,9 +80,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_d= evice *dev) pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)) && ipv6_hdr(skb)->nexthdr =3D=3D IPPROTO_ICMPV6) { - struct nd_msg *msg, _msg; + struct nd_msg *msg; =20 - msg =3D br_is_nd_neigh_msg(skb, &_msg); + msg =3D br_is_nd_neigh_msg(skb); if (msg) br_do_suppress_nd(skb, br, vid, NULL, msg); } diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index ddb8f002a40e..d87a5f9fa92b 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -176,9 +176,9 @@ int br_handle_frame_finish(struct net *net, struct sock= *sk, struct sk_buff *skb pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)) && ipv6_hdr(skb)->nexthdr =3D=3D IPPROTO_ICMPV6) { - struct nd_msg *msg, _msg; + struct nd_msg *msg; =20 - msg =3D br_is_nd_neigh_msg(skb, &_msg); + msg =3D br_is_nd_neigh_msg(skb); if (msg) br_do_suppress_nd(skb, br, vid, p, msg); } diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index f8f77a2d4891..a51246747537 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -2365,7 +2365,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, st= ruct net_bridge *br, u16 vid, struct net_bridge_port *p); void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, u16 vid, struct net_bridge_port *p, struct nd_msg *msg); -struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb, struct nd_msg= *m); +struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb); bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid= ); bool br_is_neigh_forward_grat_enabled(const struct net_bridge_port *p, u16= vid); #endif --=20 2.54.0 From nobody Sat Jul 25 03:45:46 2026 Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11010021.outbound.protection.outlook.com [52.101.56.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28FEB2C0298; Sun, 19 Jul 2026 13:35:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.56.21 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468144; cv=fail; b=oBgJb81DAg9i6RcW7NhfnAfFdoz/QFBqi58x+4q2GXcCIMhqRZtJQ2/cYm5pqF+aVSYrEBhwGZWavwUjYXSJQD4DXtlCpmqQG4JYNdR+NL0m1asgj1M4S9gXywOglZkev25VVlxjPwpS79GbRf7/7LcsKQGrA9nY0Su6ic9PUVc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468144; c=relaxed/simple; bh=DNY7sFNO5BEtjcQcjRRDaNTfSlpsMejptcNJRMmNc9g=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ppT+Wpx+JsUuZhyNaCfVofBzzEotReBv27dpQm021A4xZ7DPFxh5jVOoe1+QKXO88573hS4ZklxcycAEYMxmGB4/qHs6WObcMs3m2fTDCggjBGkwXMQZ/TBvq85w6VoDJ/vkptNVTkx24r7JxXJRgo/G3j+qq4P7lrQGn5j9AU0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=s6JM/2Wq; arc=fail smtp.client-ip=52.101.56.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="s6JM/2Wq" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Dgvkty/uwi50QRgkoRyKqtsGflrt7uQ58s5nFabGDLPiYijtVFJvn6VcTgoa1COEyf8vCAjKk0nPfNFYfKD9dNomDLIR6Sr/PQPi5zv8iD+KT4SN997S4OUOTAJK0y3+9HvzcGszs84CRWZtMhQKZmMuH/ncqpA4w/iA3ncw1LktMOOUDFMx/KlG78sh0CsBNo2txIHyMZKp1R2nXQ3OBb4E5ESYg6szfCm6wIG8hZZ0wNSYIJUcDdfcHJ0Njp0p47ZyXP861H2XVYdUtorqI48DAM0wYky2v9wLyb0oBidprQD9cpHKjGIQitqV0WR+O4YHGPhd6kK+hNmtxyDjCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Jpz+3c2YVt+4FGb/Hatv1W2zUAWmS6B/G1JFZPp4lXs=; b=SkgM0J9mfs57sRParLmALI9svBl8s77lLBNSg+AaTBrv+kJmIa17dxAGm/CTBIRklJO2rpXST3OXW/hFfxeE1/Tpzz+n7vma4643CFmTwdo1FWtrYmzABqEah2a5fcLNQyS9eRNh2R5hFyei4YAgEVtXpNOXg8TcTyg1ZazWRpBUXu4z/F4baWxUPP4lcGWnBFxKzrXlj8odvVYvlTuq8SgTBE62NlflJ19Ce3KZl0UG5sFhflY6Qvx6PjsYlFoUXrzQe4YnEyZDOwvrAUnjfPkzhN1fx+KUAnmVPHkpYsRYnhrqUKpPk97ScKdvFqCUq2cpTG6+l5kaAnJcacX20w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jpz+3c2YVt+4FGb/Hatv1W2zUAWmS6B/G1JFZPp4lXs=; b=s6JM/2WqMaXdxwIsp5YkF8FVj/uzughGTP88wSBaQ6VcC0q9cqbbSA9/3e1bdtPFAOxDirdm441RKmWvIHr3xUNSvZlNTFm0CXAOTrJHKSN5OScXjLYwIDVrHx5ovPO1jR5pIkfSFog21E+OSkoh08dB1DRSbsbBAthAMb7kqZF4+olybVblXpGpDvxAbXOenTKEkQsg9e3rpYxUWGqUP7lh5sEERMJZCuam1WzdVHfnfvdWJG8xXWUz1Xei4U8/8lxTXY5Sv066pRmRYL+yGiTwNKlAEv7laoMRyabG3SK7uDVj7kcB97TLUUOHg2vn4MvxShbrjCqbkcSP8MA6Yg== Received: from PH8PR02CA0001.namprd02.prod.outlook.com (2603:10b6:510:2d0::19) by MW6PR12MB8733.namprd12.prod.outlook.com (2603:10b6:303:24c::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.13; Sun, 19 Jul 2026 13:35:36 +0000 Received: from SA2PEPF00003F66.namprd04.prod.outlook.com (2603:10b6:510:2d0:cafe::83) by PH8PR02CA0001.outlook.office365.com (2603:10b6:510:2d0::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 13:35:36 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SA2PEPF00003F66.mail.protection.outlook.com (10.167.248.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 13:35:36 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:22 -0700 Received: from dev-r-vrt-155.mtr.labs.mlnx (10.126.230.37) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:18 -0700 From: Danielle Ratson To: CC: , , , , , , , , , , , , , , Danielle Ratson Subject: [PATCH net-next 2/5] ipv6: ndisc: Add ndisc_check_ns_na() validation helper Date: Sun, 19 Jul 2026 16:34:52 +0300 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF00003F66:EE_|MW6PR12MB8733:EE_ X-MS-Office365-Filtering-Correlation-Id: 4351d7c8-84b7-42e2-970c-08dee59a9d83 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|36860700016|7416014|376014|1800799024|11063799006|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: 8m0FEvE4B2fA4fFuojZEmbL4F7td02sxiinBsOckUOvMShZBzC8458eZxS3T/zWBh7/6yi/R+R3JyEX3U/uoa60EuavBtjk5otSBkgpN/ZOeOWGRJWoY4GVg661bQqIjsFD4UvtjZFdd9g4gzm+RLaawvDDgRPh9uh40dQ4CMEDipRQMcgATm4ojrFd2f3Xe6bzAefosP9rRzP5smHbVhawcKeI7glLbmxMItH4pRGPx+phQWWKZRVxzRE4JoLBibq2a79TKdvrdjR824ZA237KQskf+LL7cJH05+3L+njLlNT/RcPoLaRVz4gZNmS2GeOF17X0rvm/iahf2Y8YHUeQ/3E57suiFbPNxk67l6cy261/rULPdGswFXO2XG5AGS/Y+yAjK8ivIYkTgIAaSR77meL3t5tiWi31VK0Ukazhx/pJ+1lLUd6EDB5psTjycv77ptPdVnRyhQOqjxry3iNSBd2bbRGSducdPUhW7SO59n9VNGr9fgVetdZ1eovZP4c9X7eSLktR+x+LnAZADPFNDDvcnpwI9VQ3xmWvbGszkRqC+T9iu97fUiQVjgPR/bZjHcdEhyAm4p/Pl0J5W5010AlCIv5ADLn1KJ6jE5dWYaGkaBobfmYin0QH/psL1DPVW2vkMro5aKKt2wgvsRCd8jnUgIzbBkKngnUyv675CUCqmdizIZvrDS74jSQTmtZy8U7dVLRh+0PKz5pO3aw== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(36860700016)(7416014)(376014)(1800799024)(11063799006)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: IyfL/EnFR58FigtiSzzDBIQZavg/LsjHxtmyHr+Le8+GpXIxuZV3/jbnj+F4DpFLHEOIA+k5O4FUTUVyBB3eTk0QNR3t80eKrKLMsZO0ikFr//TATR5s7ZWsWxW+r8USc/ZMHQc598bFtS4dc3X8zVBNwX1SOGmk6HguAVpD9XhGbguOmZc0+//hF74GKrL4LRy2p+4Iu8luy2HvPXt3OsdzKUyfc6Wc0wBqrFQN0F3RQS722H+ExpwdediQCahAPCRDqE3LWXzRr6XrU0gDFyKtmuLbrLLs8kDnlL57ug2ai0Yxy//Cw+mW3LemKaE9WiBUtC16zmrs/JniEsLKv72GDb0zXWK7lOPhyMozpIRje2dbgI2XsRhcO59z7g45FNcTUVbcTPQnh+oKIPzgNSY5irw1Pvl1x5FsvIUpfLNSBYcpzaIOn9+qpImm8mUP X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2026 13:35:36.2139 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4351d7c8-84b7-42e2-970c-08dee59a9d83 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003F66.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR12MB8733 Content-Type: text/plain; charset="utf-8" Add ndisc_check_ns_na(), a standalone NS/NA packet validator modeled after ipv6_mc_check_mld(). It performs the RFC 4861 section 7.1.1 (Neighbor Solicitation) and 7.1.2 (Neighbor Advertisement) mandatory checks that are relevant for software operating at the bridge level, where packets bypass the normal IPv6 stack path: - Hop Limit must be 255 (packet was not forwarded by a router) - ICMPv6 checksum is valid - ICMP Code is 0 - ICMP length is at least 24 octets (sizeof(struct nd_msg)) - Target Address must not be a multicast address - All included options have a length that is greater than zero - NS/DAD: destination must be a solicited-node multicast address - NS/DAD: no Source Link-Layer Address option when source is unspecified - NA: Solicited flag must be 0 when IP Destination is multicast On success the function sets the skb transport header and returns 0, matching the convention of ipv6_mc_check_mld(). Reviewed-by: Petr Machata Signed-off-by: Danielle Ratson Acked-by: Nikolay Aleksandrov --- include/net/ndisc.h | 2 + net/ipv6/Makefile | 2 +- net/ipv6/ndisc_snoop.c | 190 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 193 insertions(+), 1 deletion(-) create mode 100644 net/ipv6/ndisc_snoop.c diff --git a/include/net/ndisc.h b/include/net/ndisc.h index 3da1a6f8d3f9..9e5379ad2d8e 100644 --- a/include/net/ndisc.h +++ b/include/net/ndisc.h @@ -430,6 +430,8 @@ void ndisc_update(const struct net_device *dev, struct = neighbour *neigh, const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type, struct ndisc_options *ndopts); =20 +int ndisc_check_ns_na(struct sk_buff *skb); + /* * IGMP */ diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile index 5b0cd6488021..cf5e01f83ce3 100644 --- a/net/ipv6/Makefile +++ b/net/ipv6/Makefile @@ -51,7 +51,7 @@ obj-$(subst m,y,$(CONFIG_IPV6)) +=3D inet6_hashtables.o =20 ifneq ($(CONFIG_IPV6),) obj-$(CONFIG_NET_UDP_TUNNEL) +=3D ip6_udp_tunnel.o -obj-y +=3D mcast_snoop.o +obj-y +=3D mcast_snoop.o ndisc_snoop.o obj-$(CONFIG_TCP_AO) +=3D tcp_ao.o endif =20 diff --git a/net/ipv6/ndisc_snoop.c b/net/ipv6/ndisc_snoop.c new file mode 100644 index 000000000000..a93eed27a1f6 --- /dev/null +++ b/net/ipv6/ndisc_snoop.c @@ -0,0 +1,190 @@ +// SPDX-License-Identifier: GPL-2.0-only + +#include +#include +#include +#include +#include + +static int ndisc_check_ip6hdr(struct sk_buff *skb) +{ + const struct ipv6hdr *ip6h; + unsigned int offset, len; + + offset =3D skb_network_offset(skb) + sizeof(*ip6h); + if (!pskb_may_pull(skb, offset)) + return -EINVAL; + + ip6h =3D ipv6_hdr(skb); + + if (ip6h->version !=3D 6) + return -EINVAL; + + if (ip6h->nexthdr !=3D IPPROTO_ICMPV6) + return -ENOMSG; + + /* RFC 4861 7.1.1 / 7.1.2: must not have been forwarded by a router */ + if (ip6h->hop_limit !=3D 255) + return -EINVAL; + + len =3D offset + ntohs(ip6h->payload_len); + if (skb->len < len || len <=3D offset) + return -EINVAL; + + skb_set_transport_header(skb, offset); + + return 0; +} + +static __sum16 ndisc_validate_checksum(struct sk_buff *skb) +{ + return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo); +} + +static int ndisc_check_icmpv6(struct sk_buff *skb) +{ + unsigned int len =3D skb_transport_offset(skb) + sizeof(struct icmp6hdr); + unsigned int transport_len =3D ipv6_transport_len(skb); + struct sk_buff *skb_chk; + struct icmp6hdr *hdr; + + if (!pskb_may_pull(skb, len)) + return -EINVAL; + + /* RFC 4861 7.1.1 / 7.1.2: the ICMPv6 checksum must be valid */ + skb_chk =3D skb_checksum_trimmed(skb, transport_len, + ndisc_validate_checksum); + if (!skb_chk) + return -EINVAL; + + if (skb_chk !=3D skb) + kfree_skb(skb_chk); + + /* RFC 4861 7.1.1 / 7.1.2: Code must be 0 */ + hdr =3D (struct icmp6hdr *)skb_transport_header(skb); + if (hdr->icmp6_code !=3D 0) + return -EINVAL; + + return 0; +} + +static int ndisc_check_options(struct sk_buff *skb, unsigned int opts_len, + bool reject_slla) +{ + unsigned int offset =3D skb_transport_offset(skb) + sizeof(struct nd_msg); + struct nd_opt_hdr *opt, _opt; + + while (opts_len > 0) { + if (opts_len < sizeof(*opt)) + return -EINVAL; + + opt =3D skb_header_pointer(skb, offset, sizeof(_opt), &_opt); + if (!opt) + return -EINVAL; + + /* RFC 4861 7.1.1 / 7.1.2: all option lengths must be > 0 */ + if (!opt->nd_opt_len) + return -EINVAL; + + /* RFC 4861 7.1.1: DAD NS must not contain a source link-layer + * address option + */ + if (reject_slla && opt->nd_opt_type =3D=3D ND_OPT_SOURCE_LL_ADDR) + return -EINVAL; + + if (opt->nd_opt_len * 8 > opts_len) + return -EINVAL; + + offset +=3D opt->nd_opt_len * 8; + opts_len -=3D opt->nd_opt_len * 8; + } + + return 0; +} + +static int ndisc_check_nd_msg(struct sk_buff *skb) +{ + unsigned int len =3D skb_transport_offset(skb) + sizeof(struct nd_msg); + unsigned int transport_len =3D ipv6_transport_len(skb); + bool reject_slla =3D false; + const struct nd_msg *msg; + + if (!pskb_may_pull(skb, len)) + return -EINVAL; + + /* RFC 4861 7.1.1 / 7.1.2: ICMP length is at least sizeof(nd_msg) */ + if (transport_len < sizeof(struct nd_msg)) + return -EINVAL; + + msg =3D (struct nd_msg *)skb_transport_header(skb); + + /* RFC 4861 7.1.1 / 7.1.2: Target Address must not be a + * multicast address + */ + if (ipv6_addr_is_multicast(&msg->target)) + return -EINVAL; + + switch (msg->icmph.icmp6_type) { + case NDISC_NEIGHBOUR_SOLICITATION: + if (ipv6_addr_any(&ipv6_hdr(skb)->saddr)) { + /* RFC 4861 7.1.1: DAD NS destination must be a + * solicited-node multicast address + */ + if (!ipv6_addr_is_solict_mult(&ipv6_hdr(skb)->daddr)) + return -EINVAL; + /* RFC 4861 7.1.1: DAD NS must not contain a source + * link-layer address option + */ + reject_slla =3D true; + } + break; + case NDISC_NEIGHBOUR_ADVERTISEMENT: + /* RFC 4861 7.1.2: Solicited flag must be 0 for + * multicast destinations + */ + if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) && + msg->icmph.icmp6_solicited) + return -EINVAL; + break; + default: + return -ENODATA; + } + + return ndisc_check_options(skb, transport_len - sizeof(struct nd_msg), + reject_slla); +} + +/** + * ndisc_check_ns_na - validate an NS/NA packet and set its transport head= er + * @skb: the skb to validate + * + * Validates an IPv6 packet for compliance with RFC 4861 sections 7.1.1 + * (Neighbor Solicitation) and 7.1.2 (Neighbor Advertisement). If valid, + * sets the skb transport header. + * + * Caller needs to set the skb network header. + * + * Return: + * * 0 - valid NS/NA; the skb transport header has been set. + * * -EINVAL - a broken packet was detected, i.e. it violates some + * internet standard. + * * -ENOMSG - IP header validation succeeded but it is not an ICMPv6 + * packet. + * * -ENODATA - IP+ICMPv6 header validation succeeded but it is not a + * Neighbor Solicitation or Neighbor Advertisement. + */ +int ndisc_check_ns_na(struct sk_buff *skb) +{ + int ret; + + ret =3D ndisc_check_ip6hdr(skb); + if (ret < 0) + return ret; + + ret =3D ndisc_check_icmpv6(skb); + if (ret < 0) + return ret; + + return ndisc_check_nd_msg(skb); +} +EXPORT_SYMBOL(ndisc_check_ns_na); --=20 2.54.0 From nobody Sat Jul 25 03:45:46 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010061.outbound.protection.outlook.com [40.93.198.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D16530C608; Sun, 19 Jul 2026 13:35:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.61 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468147; cv=fail; b=eKiZayUSNYQ1ONBBe7kz2/smxskyDhc3t/oC2zfUr61xXo+FPhqEZaKa8t+EtODKlgABSEDFOl0+eMVIzrih13DK+rykWRjM4oYj7/pCOKim1ns2GtsYJt4BZ23+0BTEi88f5xgdB51mJOGjUjx4XLyWmYPd4PaM4lrsNhtnFkw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468147; c=relaxed/simple; bh=uK0fotdcb2uHAsTZJTUIWQLeke1J0CAY8c2P9B9c8i0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XYrTjEt/tSjsFsqNr9vgJCm0K3PsLj3G2TzEM3Z/SgLYsgbD3xswSsOpHDTg6wfYNriL2afxB0yrAXVjgTV78E2M7goEjMFzTnEmcWmwHtc7R7/8UKEJGACyok13qHisa10WlpRxL3qXNDttxlg7/SQsiJUeJMY9uhu3fw1K5kM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=fuyMxjYL; arc=fail smtp.client-ip=40.93.198.61 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="fuyMxjYL" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tR54hu/sQUiNHPTVwTo4I+8xv2JnwAvXRYU5NXEMndHP+792iY3P+BED3eiTXkKes36yJIQ7H4wAiApX6+pKEFc+GiSJsg/xUgNQaBGEU+gyxPWWM0OXfMbbkmIThbIV5hrCIUPlh0cUS56FlromHrWCo/VPrBAn93ucZjNJyMQGu3tPkYIS6NGtWwqeo7uX0htMrxTNL3kbFZVt5uvsuYRINy49P7xgECnD9kEsL2+sINyr7M2rsSPVLu3YyFLjEn7buwotiayaDMriAeoQHKyMh4axCnPPmb+KuqceUrpYo3/eGTF7JEUDOFZf4z2bTWxBu+Ozjby5B9+RzfzpaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zZa8Xz6TwN3nCzvrg5E/leVt7WVX239o5S0f0OKHta8=; b=GdiS/dfA2DowJNc+KVHyC9FeiyWjREn9bykfEXTtnfitVm1GHc1WWqDSPNkjBeacWClRfiCVqzGSRNIvK07z0Ak7HpLpxd4Zgf/leaF8llTrUCSAWUmu5UGK7qRAQS5+55lWkVboSW8Ypu7F/cDjt/LHeSDnSA0WEMfnSPhI4EVG5RuH5uX4oy6BZlZSBuRH6ZzmT0s3MsIAkaZE/xKClPLZx7ikTdoSsOrr77mu4PihO7o5Ft6nyR0b0OjAXf2RcmstOCBdPgAJXyiSEwoI4f04x58hVHOPJb5qmGgrJtcmLOnt3Qjt9QD9z+L+DxBYhnhQQAAM6ICVjW5j3Wysiw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zZa8Xz6TwN3nCzvrg5E/leVt7WVX239o5S0f0OKHta8=; b=fuyMxjYLVNErQDr8E/Obv2sBsorkcsgQsz9s0COOad09qktm7mftq6ovAvxP2mq9xdk1VO2tqK44p3h+U+2mhqyGBkbgy2T7G2F2MnZXig5AWRNs/rVKGcqgvxFibisQeTUzIZuyE3Pmm1cAT7jKzE4sHNiFNP03yafn7i2nlzJCkpzIeKWYBO0ZD14PzWa+jvxqgBn9l9B+ka+TZnZ4LqGVieCNWjGsQva1bSvMiDrB2caQXzdJ7M/8ukryutkSAD+mVrYGQ40bOTnVNP8CQGRsy4q+Luv9zJxxEH2eSdadL2ItO29UtyX2i1o5eQKanR7VmG2Ow3aiscBxN8JW5A== Received: from PH2PEPF0000385A.namprd17.prod.outlook.com (2603:10b6:518:1::7c) by DS3PR12MB999240.namprd12.prod.outlook.com (2603:10b6:8:38f::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.14; Sun, 19 Jul 2026 13:35:40 +0000 Received: from SA2PEPF00003F63.namprd04.prod.outlook.com (2a01:111:f403:f90f::6) by PH2PEPF0000385A.outlook.office365.com (2603:1036:903:48::3) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 13:35:40 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SA2PEPF00003F63.mail.protection.outlook.com (10.167.248.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 13:35:40 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:27 -0700 Received: from dev-r-vrt-155.mtr.labs.mlnx (10.126.230.37) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:22 -0700 From: Danielle Ratson To: CC: , , , , , , , , , , , , , , Danielle Ratson Subject: [PATCH net-next 3/5] bridge: Validate NS/NA messages using ndisc_check_ns_na() Date: Sun, 19 Jul 2026 16:34:53 +0300 Message-ID: <63efa708b4b0bd9edb3a6f6a521cb5022c43aaa5.1784463131.git.danieller@nvidia.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF00003F63:EE_|DS3PR12MB999240:EE_ X-MS-Office365-Filtering-Correlation-Id: d13faf4a-8b1e-4de1-53c0-08dee59a9fe2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|23010399003|36860700016|82310400026|1800799024|10067099003|56012099006|11063799006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: SUbrF7TaUwEOV3Ktob64VK6IQSZkFYQWTzzeuy3NqnIvJSEeHA2bAmCEongyGuQgqzH77WNpXQk0caapjSEbKf89TV/ndAk4LyQYzT/weJDgRATBeubJLTIH0AdjkiMScxrFr0lHL9PEt483v3cZpqBnqNYA/WxU66awf+nE6S6E2a0Z5ay8V+kmRndnS6ZfstFwkO3TJ9mjws7qLoy1vwvDccE+pzAv3NlMwKXopVPOB2n0B5VIeJYayjjPW1f9QPUP+9Wynsf399gOzGlI0ze9n0cHdShaSwTDfhqgiU0jXituB37unFu2K5SfM4XUrvC5/6ps3GDwH4z+c8lJY29k+FxMUNni9YOqdFjST6DIDTgt6EiBul5W3C7JuIvBdAmEmb1ybPz+2Cn/5Bp0j0no0HpF2n6nfg7kVKaZBuyVD7o8tXxSyp/d8K2Pj1EtpLePAEXV6ow9wSHRhSipM+fDeMyRvYG6cJbA/LCpYqQrG2aMEH+5Oka9NNe1jBAxGdMrEgA6LsecpmyG7ZbqD80mS9dMrqw7zeGLWZ/WO6QLkNyl8xHYlGmDdvWOpHSn0x2OLxPZvOTPi90FAYcc3SxDpGQmVbdw+nt8RbMeTBlr/3oIKUntQ5PlD60jqc9c8cxGGw7E3O+eJ7kjK5LWIqj8k33dOwQMQqi/7GYa8tW3tC/QrTPd3eSg6ifIsHW+Mrw1vDUHIG2EZYH4Yt6RmQ== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(7416014)(23010399003)(36860700016)(82310400026)(1800799024)(10067099003)(56012099006)(11063799006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: miK+75VQ7BrUjFOw1ElvJGHNs8slrFpgWVT/BCGhVZFumIN4/HdJwEHcR8DGFpCOaAJq2tIDo/cBueuLqhnR6MaXx+xTVviYKRBxWkoU81g7lwaUeqk/l/HJNY9rJNSlN6lWKeoOo3yKx1E+qLISO3zBF7w3FxVYUMttU9tOGI/nyNlYUV7JDIClr05Xkp7og/oghXdWimDxN8cX2aQxLj5UuPDJj8TnSJBs0cYQ1otfMTkAbOaMLGPesHz3PYBXc9yoR82gjfuS9zdd1JUDrK0ItDcMqE7IcnREvr6ZdPjUg1dij1idC6676/ZML+MaQTfwAfdibeH0n+A8Lpch5Ie/MIsuJgVhXBfHPAipVmobX1P4xEOGUJY1WV3+qgTAqc8YqguOWylSKGyojkYSwu+pnAzCKeeBZIRWqZ+diPSKA+Qm9KFYQyYrq95JQqPZ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2026 13:35:40.1856 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d13faf4a-8b1e-4de1-53c0-08dee59a9fe2 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003F63.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS3PR12MB999240 Content-Type: text/plain; charset="utf-8" The bridge performs neighbor suppression by snooping NS/NA messages, but previously only checked the ICMPv6 type and code. This leaves it open to acting on malformed or spoofed packets that any RFC-compliant node should reject. Wire br_is_nd_neigh_msg() into the new ndisc_check_ns_na() helper, which enforces the full RFC 4861 section 7.1.1/7.1.2 receive validation: hop limit of 255, valid checksum, correct code, and type-specific rules (NS target not multicast; NA solicited flag clear for multicast destinations). MLD messages are already validated by ipv6_mc_check_mld() before the bridge acts on them; this brings NS/NA to the same standard. As a side effect, the skb parameter of br_is_nd_neigh_msg() changes from const to non-const, since ndisc_check_ns_na() may reallocate the skb head via pskb_may_pull() and sets the transport header. The returned pointer is now derived from skb_transport_header() rather than a direct cast. Reviewed-by: Petr Machata Signed-off-by: Danielle Ratson Acked-by: Nikolay Aleksandrov --- net/bridge/br_arp_nd_proxy.c | 11 ++++------- net/bridge/br_private.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index db08c3272001..445c930ed59b 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -19,6 +19,7 @@ #include #if IS_ENABLED(CONFIG_IPV6) #include +#include #endif =20 #include "br_private.h" @@ -234,16 +235,12 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, st= ruct net_bridge *br, #endif =20 #if IS_ENABLED(CONFIG_IPV6) -struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb) +struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb) { - struct nd_msg *m =3D (struct nd_msg *)(ipv6_hdr(skb) + 1); - - if (m->icmph.icmp6_code !=3D 0 || - (m->icmph.icmp6_type !=3D NDISC_NEIGHBOUR_SOLICITATION && - m->icmph.icmp6_type !=3D NDISC_NEIGHBOUR_ADVERTISEMENT)) + if (ndisc_check_ns_na(skb)) return NULL; =20 - return m; + return (struct nd_msg *)skb_transport_header(skb); } =20 static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index a51246747537..81b807487dcc 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -2365,7 +2365,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, st= ruct net_bridge *br, u16 vid, struct net_bridge_port *p); void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, u16 vid, struct net_bridge_port *p, struct nd_msg *msg); -struct nd_msg *br_is_nd_neigh_msg(const struct sk_buff *skb); +struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb); bool br_is_neigh_suppress_enabled(const struct net_bridge_port *p, u16 vid= ); bool br_is_neigh_forward_grat_enabled(const struct net_bridge_port *p, u16= vid); #endif --=20 2.54.0 From nobody Sat Jul 25 03:45:46 2026 Received: from MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azon11012025.outbound.protection.outlook.com [52.101.48.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88CEF2EA749; Sun, 19 Jul 2026 13:35:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.48.25 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468151; cv=fail; b=Apioi0/e0F8mFqiALnGzWqhrpETJAVfxWBRrSBHqlzfeNeqPel2EaOgDqvOm0nq76osINl1WDHogZVCBviiOj3FUINSSEV3eHLeUHLLCYOMhGpTzyGxNAys9UgTnhh+L+hCyGdB9dBscwYoZv1SFOU5k0Eainlzxz23KYUjosPU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468151; c=relaxed/simple; bh=pjTng4NxRUecWBbCK062TptorfY95SyyKaJ2GqKgYP8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=p9jYavW28l4d4Yk++epw4VMQOIPU4WK84cs92EDxk0fEXr99VeYjmV9DSbEO8YQTWnjxyv4PgvcTJvagbsWNmPcXsl1B6yU8F842UBdAMTckln7YY7sCP13BcsllZYIcUz7MhKa76Tq7enZj3NONA/oHJtd+9I0V1PKmKzSanIw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ZvL2sojY; arc=fail smtp.client-ip=52.101.48.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ZvL2sojY" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WuILuwjO/eR37RggA4/7QhmEvVnazDyY7TRFzHtzP5jrJZwvvXtzMDDZvBXPEYeMh8bTVH7/FE1N7aEtw1hAN5To1HuPx2Vcc5O4zfY3gn2DOBL/D2buq4A0kRXMirlRr7gC7GTQ4YTKaUr7hBrz16NBW2+/zChQWr6HfAGuDmhvRjIItDWTTibAHKBjTUSFtG8KW8CO+FC+44a61K5i3J+nfbLnbLQWP0ZhyLP5jFu7TTTP2azqV34CZEu90pXyJQUx7+B9wxbr89O3mrm+L+LbhSVGMukPZYZHeFN1SbFVBWKZHjYQVyDCMAPBGW66puvwR43by1JsqTRR/m8+lg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=V//h+8E0urO2Spfg/tqjEEC0CFHZhn9AfZtmQHo7swk=; b=wpkFasyJ7mLMyFK7Tabncc/Ly/q8vaSDJzcA/DJYVnEoSy+nrEMpfJDkxYsoIbcz8+Tgy2vV3ns+xxWiqn2Wlm6sVZthXxv3/6lwJZH+2oYxk8z1i/MeXrFlbvBxJSpMseyT4L7rrhiotIeK2+w8c1DxAIGbHg1t797DZ9KQiM0wMGCkMMTsZCeqQLiyu8SihHmAtXCuxPv+9k+9CEI8uihUVy6/X0N+PYF9AnSClB/NthMdpUP84AXXxPfAFFnH99Sz5rgCoaaDmbG3ivfPVd3AFHFx/NozXwycIRhuD1KRImfvsOrx9/n6RRU6FwKtgiVoo/aY+xQfoNgYyaRqSg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=V//h+8E0urO2Spfg/tqjEEC0CFHZhn9AfZtmQHo7swk=; b=ZvL2sojYxaUu2kixcFx+wj5aF8vLOKpJCVxKNjVOuYSW/JRcny6Gd7POKpPSw+G0LDnF4RDbGfvl7M/Oz5RmdTfuUcoD63BE5GlnStRGFWe6iAWmpwyvpQ8B5t6uhRpYnNB4I4MD2FuUzGvYr3xEToXjSzCBI/n/T3B7onli+5N/9sLGrTu+koY2u1Ij35UQGACDYUy+4dC6vBsaR8vS3vmk/3emKb4+QGLu3rFLMLNhIqnT2YybvoIhUbRLaBgosRk9f5DwPBLcvko1xgjEyvND3slloGEQ7OLQ0jF596qO8j269BZnRAWdkOxHTI3E5dR3e3K8RXjpLtAVb3bO5w== Received: from PH2PEPF0000385A.namprd17.prod.outlook.com (2603:10b6:518:1::7c) by PH7PR12MB5949.namprd12.prod.outlook.com (2603:10b6:510:1d8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.15; Sun, 19 Jul 2026 13:35:45 +0000 Received: from SA2PEPF00003F63.namprd04.prod.outlook.com (2a01:111:f403:f90f::6) by PH2PEPF0000385A.outlook.office365.com (2603:1036:903:48::3) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 13:35:45 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SA2PEPF00003F63.mail.protection.outlook.com (10.167.248.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 13:35:45 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:31 -0700 Received: from dev-r-vrt-155.mtr.labs.mlnx (10.126.230.37) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:27 -0700 From: Danielle Ratson To: CC: , , , , , , , , , , , , , , Danielle Ratson Subject: [PATCH net-next 4/5] bridge: Linearize skb once the ND message type is validated Date: Sun, 19 Jul 2026 16:34:54 +0300 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF00003F63:EE_|PH7PR12MB5949:EE_ X-MS-Office365-Filtering-Correlation-Id: 244bb362-5727-496d-62ff-08dee59aa2ef X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|36860700016|7416014|376014|1800799024|10067099003|56012099006|11063799006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: neJHm13xw1f6fkJ20/pFGGfBtaxJZR+Y7tp7NfokUoYkDMtPeVJPC25XEJUQnvZOGkXLx3/rI7K1Sk2aCuWVx4yNmafyKlReSnkoOtS9ARO3OVZPnFKEb8NLRSHAKYmnI+rM0zNcgknWazgZqTYywWYNd7AlKIueN1NRmGVA3lqFjX6JMTVjYNmWHXm/lnYnim/uqIgkV4DDFkfKiwF9hJ4ToEvddAjsVTpXDBOU8wKCecrHgsoXztC4MOIgQbRDivZEFDH93Bpxy+boEHAQw3Ho+NHYRBEsUE5TQP2/edqfkgbdwyIaGtPlN/KvVT0Obn8iq6Qi/6oXd2IR72GSJBX8ZLfu6Bprn+Ee4w8o8FWwM9ICYJUqgW5xfUUyIxDJRe8uGoDQ9TzMyvmKqV7zRRoiLYoqcAyPdPh+d7ivXYwWE0v8xi68955is25el4vo8DyRTbwNNo1mSV91+kuQpJhA8STFUhNN4atKkQQ3aAL2Q5WJkAefIQsDg4wim7fXLJMxFGUW1Tvp1pBOZ2vBNDafNCWtbI0J63Kf2ELJzJn+3+nXsS6Uj+xI0jcYD3W/+enKizZ+ICYVuEwqZe579oY56Xgsxrw4siXoJ6idh8gVAc93C02t5I3UNHhcw5acdQ9PgjivDhKc8jwWMhtgqUmPmlr2FTViJhw4MBDZbiktXOG5GjCiUPAThW2tSGQk60n5pFFqTO+Oaj74lnFReg== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(36860700016)(7416014)(376014)(1800799024)(10067099003)(56012099006)(11063799006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: MEsJOJUlphmvXx7KPkoAHu+bSkOSIwj6PikFYp3mjPaEGWfRzRZgmp0CXSNYtK22hf3EwBQH+wpQZRxNx99OS4Xb/0tO7b7ckc5Hda8b7VaXPGn36si/MGbaTRPD0RyJpkUEX14HadHrqSrxwdZM9wkFq0hWGEwhN3t3zndhmJ32+3Sl2r9NksWg6aQ+AI+k9j0RXx3TJ6diwGPQJ3bKE8ezZUpaI7/B7nCV3L3VTI7anuS5nK7J0LtS2z+6otbDAAhp6cE872Zl2ZWBPzVXbd8WA5fbMmE7hgmZ3HmekMNgV/+lciCgbHmDT8lq8hi7WbKspb3HzwSdmwRgO7wRJVbA+vMjMlfg4ggxpR9RbpBYBOAqJ0UekixPQhfW5t6tdfGFw4N0dkO7x+cj99Z0Sfp+r5ySIo2P5dKlqiMiQyzNjnG+JXkqbhwT9ag0dIc3 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2026 13:35:45.3024 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 244bb362-5727-496d-62ff-08dee59aa2ef X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003F63.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR12MB5949 Content-Type: text/plain; charset="utf-8" br_nd_send() parses ND options from ns->opt[] and therefore needs the skb to be linear. Commit a01aee7cafc5 ("bridge: br_nd_send: linearize skb before parsing ND options") ensured that by linearizing inside br_nd_send() itself. Move the linearization up into br_is_nd_neigh_msg(), right after ndisc_check_ns_na() has validated the message as an NS/NA. This makes a linear buffer a property of every recognized ND message, so that this and any future ND message handling operate on a linear skb and cannot reintroduce that class of bug by forgetting to linearize. Since the skb is now linear by the time br_nd_send() runs, drop the linearization there and derive ns from the transport header set by ndisc_check_ns_na(), instead of recomputing it from the network header. If linearization fails under memory pressure, br_is_nd_neigh_msg() returns NULL and the packet falls back to normal forwarding rather than being suppressed. Reviewed-by: Petr Machata Signed-off-by: Danielle Ratson --- net/bridge/br_arp_nd_proxy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index 445c930ed59b..46779d9fad61 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -240,6 +240,9 @@ struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb) if (ndisc_check_ns_na(skb)) return NULL; =20 + if (skb_linearize(skb)) + return NULL; + return (struct nd_msg *)skb_transport_header(skb); } =20 @@ -259,7 +262,7 @@ static void br_nd_send(struct net_bridge *br, struct ne= t_bridge_port *p, bool dad; u16 pvid; =20 - if (!dev || skb_linearize(request)) + if (!dev) return; =20 len =3D LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) + @@ -276,8 +279,7 @@ static void br_nd_send(struct net_bridge *br, struct ne= t_bridge_port *p, skb_set_mac_header(reply, 0); =20 daddr =3D eth_hdr(request)->h_source; - ns =3D (struct nd_msg *)(skb_network_header(request) + - sizeof(struct ipv6hdr)); + ns =3D (struct nd_msg *)skb_transport_header(request); =20 /* Do we need option processing ? */ ns_olen =3D request->len - (skb_network_offset(request) + --=20 2.54.0 From nobody Sat Jul 25 03:45:46 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010003.outbound.protection.outlook.com [40.93.198.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 867DA2690EC; Sun, 19 Jul 2026 13:35:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.3 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468158; cv=fail; b=W26CaE3TYJ7ly7Npu90SETn4kkk+94dZFTe5XovvXmaxdtux9bRQ7ogB9jvtZSSF3owwhwaxJg4yJyhoetOB+q008no5P7lNKsIENF/JbdqbyxMQCL3mKoeRgq2PUjWvPLi9I7yWZJfQj8ZlhwBMgZBY2iiLQDHzxTa2Iov1qC8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784468158; c=relaxed/simple; bh=8uah2dFuzqV6xQdEkjvy5Rt28sbRWiXvwnw/Aj3hhc8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=VICeV0ndb3P7VD0mgaMRKqjC4iy/t44DYY2uAcA2Saluubx2Bc3Kjg7YTZYT2fWu4eysxDREYqHI0D/mCWQeL6OrohVKlDsqySOqXKVuP/ukX5UcXSA8BFO814vLLC1LUFPktlz5R28erVoAFtYulYBtDvSJh04uT7/0GI0Vglo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=YnLJ5nZP; arc=fail smtp.client-ip=40.93.198.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="YnLJ5nZP" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OpoTPRLcn8IyUduct/AfIB4ebDWYkAHYOfc3x/u0+gU1QZT2IvES7N2LDcNzMmKolSfcJ3meHA0NiwPdYqgidstjH9ouGNpgQvOBDPLxT0hb9xxwA4AUO2rF4fXLbbMlpTOx8IooyKoMxmOSgj74c/6NtDbGBmSMdZ1ZgF47pyJkxbUGA5d9yDYvCpAg3dIaxu0g2dgA0bo1HQrFDqqpJer0Jhmg499twbzmsw0m8Dlnzt19UF7XdHhzwMJc9mq2n+1sg2KhuwJQZVWv/jX+F0c1Vdnj+VbwxsrS3JxIWsH+aFV8y1DQZ9jTOc4Y2ESqoJudBKsMfvn5+QKKBKAYgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7x0Q0DCtwC4wvHCraJ0/L4iVlxbQLIgs42mqzfGufCw=; b=Q3cXKeWISlhkgpY2e+HtZ2POinuUjp5UsKPwl8utZrkba+XhY+41ebRN04JehbCahr/xnPIuV1ouBxWIQri43hqehJ6gndNGq34EKO5VSIuXDPSF6KGwRUXF/SNeBgW0rAcGmecjGmSin05Kelq17F41DCPK1NHQ/ShWAT47cD+2C0yJhZ8NLXqM/pLCrXLOGfjfvPGlTSJ5umnxhRXozGOvaw195J+Axo0R3hgXAyfr0antchN4YG3NUt/orc5GS1f5+6AxvoyfF+ZWON7Lci+kj+tr/SGEJH8K0zuxDyV07whYqtCDCOzBHw8Ij18/C6HLr6uKcxtLuJkL1EU1qg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=vger.kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7x0Q0DCtwC4wvHCraJ0/L4iVlxbQLIgs42mqzfGufCw=; b=YnLJ5nZP2epP4OY6dOmY1HXAaxKg0IVcEBiB4IpolDoBRVzP0lkXF0ua1V+pr3axpr2VRCJDBTXn7BRbKktE3d/aRV391H4rq5UgX8IcDIFByNevBFA3DmZBzwGxkfQ2vFE2FQpQVXrHPsTQHTqdBQ2nJOgkUz1NpqoGNo9y4ahiyKmK7ol1/AEm4jg/N7temWoOr0yhb2IJxJlmFLO2vVwX4lnz2bEIsbfV61UALxYASZTHIj+tNL48v0S9HRzW4aCXhaLzLopGqlFxBGb0259JPT5MKvQQ2TzjW8GsU/u5PHgnjSGX1JxL6NcswyRUuvpsHqxtNx066PHKQTQdQg== Received: from PH2PEPF0000385F.namprd17.prod.outlook.com (2603:10b6:518:1::6d) by DM6PR12MB4137.namprd12.prod.outlook.com (2603:10b6:5:218::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.16; Sun, 19 Jul 2026 13:35:51 +0000 Received: from SA2PEPF00003F63.namprd04.prod.outlook.com (2a01:111:f403:f90f::6) by PH2PEPF0000385F.outlook.office365.com (2603:1036:903:48::3) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.16 via Frontend Transport; Sun, 19 Jul 2026 13:35:51 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by SA2PEPF00003F63.mail.protection.outlook.com (10.167.248.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.5 via Frontend Transport; Sun, 19 Jul 2026 13:35:51 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:35 -0700 Received: from dev-r-vrt-155.mtr.labs.mlnx (10.126.230.37) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Sun, 19 Jul 2026 06:35:31 -0700 From: Danielle Ratson To: CC: , , , , , , , , , , , , , , Danielle Ratson Subject: [PATCH net-next 5/5] bridge: Use ndisc_parse_options() to parse ND options in br_nd_send() Date: Sun, 19 Jul 2026 16:34:55 +0300 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF00003F63:EE_|DM6PR12MB4137:EE_ X-MS-Office365-Filtering-Correlation-Id: 20446b01-1ab7-4eeb-36af-08dee59aa65f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|82310400026|1800799024|23010399003|7416014|376014|22082099003|18002099003|56012099006|10067099003|11063799006; X-Microsoft-Antispam-Message-Info: fbPQ6iCNHjAwl3MIXUNm2Q20jiOVW0CZRGY1fFRKQrygPiRRJI+VngHdN7JuH3vJbV4x5PPw1arjryqBFK/M49IiS84yIg/BJNuQZ6RNQlI6l42WmdgFs4ud9FKwhzncT4aovCso+qWF7hknUrHFV/Y4TIfG2fElS8FHZSHolQWhQu5iC0P9VKow0e5wOp8wcaMVJDHILviePAKlCtt0kaeIV55zY8UL42X9ifqGf6qYlJmuDuF5OuvtoFgVZ2DzfNj6Iq1SzmEeBbyaclN4/jGHS63PaumOdyIHknLcvnO0uNgpneQfZpyIKJWhqkjywbyzE3kt3HlzQsprwjVLEaTAu+6GO3pwHmZjAhlh0J0psykn2ZImCynGtpCnEm30xDOsWLTLtnB456LYkFFWH9toUSG3NF1f2aEBrXcUCs0oWqXLsrzui8UqJuj0jd5XJvseiK7QO1gmokTZCLTpNYSIZIPRFGtOiZ4tkfjtZDyeXIIJ7vKAHDQ2BpHNBjs8Pi/GHj+SYcKJYwVbDSWAgv3iDhG9itYB0DDA+Tl+Lnhpppam7FA5hStX9jDwENeaamSZMC1scx50w2JOJJu9TywMyFnWREgjYDXVqm+wUjMscJpNWigyeviGdtMzR6POtjop/ZxRqMnNWrufR/29vMuoXl1mtCLYHbEHpFaE95nF+rXrhfdDlRnr/DOs3iD5BSrGnfvVjh9DvS2auWiMEA== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(82310400026)(1800799024)(23010399003)(7416014)(376014)(22082099003)(18002099003)(56012099006)(10067099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8b4fdE1+DEIWK56fs+41JzA3+Eu+H2Fr9ozbtwMwEdDbuwvI0Rsi1nyWobzm44megSkgnS03ykqAATH1xvOYbD4xTKykwi0aEHMPPMYTy6xjmKtARfoggTReXoa8UuV5O3PnczonWSfiu/E9qZ8G3yB8l4lNX2dioaru63OYyyPSAGaxs7LJ3Eda0CbWWGa2l7XmT58wxzMSClW6bd943CwPA4n8tpEuDx3s0NvuFsKSKLSlJQU6niq/r5i+9DKqCCho9fZT3SF4TfDJlrSvW9FolxI1mF9wuoaNQD8lQAqyReCxoB5bGE9+RBLEdNIDZdAC4KTmQBa7euOrq4MUrj3v3k9Q1A7J7t8gBDa/knaFizVkxSHqkkJXk9uwdT1Oy2A8sGCIC9lYeIJW8Es5C0J8ZJ2za95jkpO6/QjyN6jjEmJOwwRsyQBVPf9bHkA4 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2026 13:35:51.0693 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 20446b01-1ab7-4eeb-36af-08dee59aa65f X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003F63.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4137 Content-Type: text/plain; charset="utf-8" Replace the manual ND option parsing loop in br_nd_send() with ndisc_parse_options(), which provides proper validation and avoids the class of bugs that were fixed by commit 53fc685243bd ("bridge: Avoid infinite loop when suppressing NS messages with invalid options") and commit 850837965af1 ("bridge: br_nd_send: validate ND option lengths"). Use ndisc_opt_addr_data() to extract the source link-layer address from the parsed options, which correctly validates the option length for the underlying device type. Export ndisc_parse_options() so that it can be resolved from the bridge when it is built as a module (CONFIG_BRIDGE=3Dm); otherwise modpost fails with an undefined symbol. Reviewed-by: Petr Machata Signed-off-by: Danielle Ratson Acked-by: Nikolay Aleksandrov --- net/bridge/br_arp_nd_proxy.c | 32 +++++++++++++++++--------------- net/ipv6/ndisc.c | 1 + 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index 46779d9fad61..7863beae0c55 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -252,15 +252,16 @@ static void br_nd_send(struct net_bridge *br, struct = net_bridge_port *p, { struct net_device *dev =3D request->dev; struct net_bridge_vlan_group *vg; + struct ndisc_options ndopts; struct nd_msg *na, *ns; struct sk_buff *reply; struct ipv6hdr *pip6; int na_olen =3D 8; /* opt hdr + ETH_ALEN for target */ int ns_olen; - int i, len; u8 *daddr; bool dad; u16 pvid; + int len; =20 if (!dev) return; @@ -281,20 +282,21 @@ static void br_nd_send(struct net_bridge *br, struct = net_bridge_port *p, daddr =3D eth_hdr(request)->h_source; ns =3D (struct nd_msg *)skb_transport_header(request); =20 - /* Do we need option processing ? */ - ns_olen =3D request->len - (skb_network_offset(request) + - sizeof(struct ipv6hdr)) - sizeof(*ns); - for (i =3D 0; i < ns_olen - 1; i +=3D (ns->opt[i + 1] << 3)) { - if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) { - kfree_skb(reply); - return; - } - if (ns->opt[i] =3D=3D ND_OPT_SOURCE_LL_ADDR) { - if ((ns->opt[i + 1] << 3) >=3D - sizeof(struct nd_opt_hdr) + ETH_ALEN) - daddr =3D ns->opt + i + sizeof(struct nd_opt_hdr); - break; - } + /* Derive the option length from the IPv6 payload length so that any + * trailing L2 padding in the skb is not parsed as ND options. + */ + ns_olen =3D ntohs(ipv6_hdr(request)->payload_len) - sizeof(*ns); + if (!ndisc_parse_options(dev, ns->opt, ns_olen, &ndopts)) { + kfree_skb(reply); + return; + } + + if (ndopts.nd_opts_src_lladdr) { + u8 *lladdr; + + lladdr =3D ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev); + if (lladdr) + daddr =3D lladdr; } =20 dad =3D ipv6_addr_any(&ipv6_hdr(request)->saddr); diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index f867ec8d3d90..d8b4588f6bff 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -283,6 +283,7 @@ struct ndisc_options *ndisc_parse_options(const struct = net_device *dev, } return ndopts; } +EXPORT_SYMBOL(ndisc_parse_options); =20 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device= *dev, int dir) { --=20 2.54.0