14 Aug, 2015

1 commit

  • The recent refactoring of the IGMP and MLD parsing code into
    ipv6_mc_check_mld() / ip_mc_check_igmp() introduced a potential crash /
    BUG() invocation for bridges:

    I wrongly assumed that skb_get() could be used as a simple reference
    counter for an skb which is not the case. skb_get() bears additional
    semantics, a user count. This leads to a BUG() invocation in
    pskb_expand_head() / kernel panic if pskb_may_pull() is called on an skb
    with a user count greater than one - unfortunately the refactoring did
    just that.

    Fixing this by removing the skb_get() call and changing the API: The
    caller of ipv6_mc_check_mld() / ip_mc_check_igmp() now needs to
    additionally check whether the returned skb_trimmed is a clone.

    Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code")
    Reported-by: Brenden Blanco
    Signed-off-by: Linus Lüssing
    Acked-by: Alexei Starovoitov
    Signed-off-by: David S. Miller

    Linus Lüssing
     

05 May, 2015

2 commits

  • > net/core/skbuff.c:4108:13: sparse: incorrect type in assignment (different base types)
    > net/ipv6/mcast_snoop.c:63 ipv6_mc_check_exthdrs() warn: unsigned 'offset' is never less than zero.

    Introduced by 9afd85c9e4552b276e2f4cfefd622bdeeffbbf26
    ("net: Export IGMP/MLD message validation code")

    Reported-by: kbuild test robot
    Signed-off-by: Linus Lüssing
    Signed-off-by: David S. Miller

    Linus Lüssing
     
  • With this patch, the IGMP and MLD message validation functions are moved
    from the bridge code to IPv4/IPv6 multicast files. Some small
    refactoring was done to enhance readibility and to iron out some
    differences in behaviour between the IGMP and MLD parsing code (e.g. the
    skb-cloning of MLD messages is now only done if necessary, just like the
    IGMP part always did).

    Finally, these IGMP and MLD message validation functions are exported so
    that not only the bridge can use it but batman-adv later, too.

    Signed-off-by: Linus Lüssing
    Signed-off-by: David S. Miller

    Linus Lüssing