Hi,

This series hardens ND option parsing in bridge and vxlan paths.

Patch 1 linearizes the request skb in br_nd_send() before walking ND
options. Patch 2 adds explicit ND option length validation in
br_nd_send(). Patch 3 adds matching ND option length validation in
vxlan_na_create().

Thanks.

Yang Yang (3):
  bridge: br_nd_send: linearize skb before parsing ND options
  bridge: br_nd_send: validate ND option lengths
  vxlan: validate ND option lengths in vxlan_na_create

 drivers/net/vxlan/vxlan_core.c |  6 ++++--
 net/bridge/br_arp_nd_proxy.c   | 18 +++++++++++-------
 2 files changed, 15 insertions(+), 9 deletions(-)

-- 
2.43.0