• Glenn Ruben Bakke's avatar
    Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address · 55441070
    Glenn Ruben Bakke authored
    The memcpy of ipv6 header destination address to the skb control block
    (sbk->cb) in header_create() results in currupted memory when bt_xmit()
    is issued. The skb->cb is "released" in the return of header_create()
    making room for lower layer to minipulate the skb->cb.
    
    The value retrieved in bt_xmit is not persistent across header creation
    and sending, and the lower layer will overwrite portions of skb->cb,
    making the copied destination address wrong.
    
    The memory corruption will lead to non-working multicast as the first 4
    bytes of the copied destination address is replaced by a value that
    resolves into a non-multicast prefix.
    
    This fix removes the dependency on the skb control block between header
    creation and send, by moving the destination address memcpy to the send
    function path (setup_create, which is called from bt_xmit).
    Signed-off-by: default avatarGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
    Acked-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    Cc: stable@vger.kernel.org # 4.5+
    55441070
6lowpan.c 30.5 KB