• Daniel Borkmann's avatar
    net: 6lowpan: fix lowpan_header_create non-compression memcpy call · 965801e1
    Daniel Borkmann authored
    In function lowpan_header_create(), we invoke the following code
    construct:
    
      struct ipv6hdr *hdr;
      ...
      hdr = ipv6_hdr(skb);
      ...
      if (...)
        memcpy(hc06_ptr + 1, &hdr->flow_lbl[1], 2);
      else
        memcpy(hc06_ptr, &hdr, 4);
    
    Where the else path of the condition, that is, non-compression
    path, calls memcpy() with a pointer to struct ipv6hdr *hdr as
    source, thus two levels of indirection. This cannot be correct,
    and likely only one level of pointer was intended as source
    buffer for memcpy() here.
    
    Fixes: 44331fe2 ("IEEE802.15.4: 6LoWPAN basic support")
    Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
    Cc: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
    Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
    Cc: Werner Almesberger <werner@almesberger.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    965801e1
6lowpan.c 38.4 KB