summaryrefslogtreecommitdiffstats
path: root/net/ieee802154
diff options
context:
space:
mode:
authorGlenn Ruben Bakke <glennrubenbakke@nordicsemi.no>2016-04-22 18:06:11 +0200
committerMarcel Holtmann <marcel@holtmann.org>2016-04-26 01:08:25 +0200
commit55441070ca1cbd47ce1ad2959bbf4b47aed9b83b (patch)
tree520b1520d798b485a4fafcda388331ac23c65027 /net/ieee802154
parent5c0e03cd9f10d541b69b667a2b1b8980f196f432 (diff)
downloadlinux-55441070ca1cbd47ce1ad2959bbf4b47aed9b83b.tar.bz2
Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address
The memcpy of ipv6 header destination address to the skb control block (sbk->cb) in header_create() results in currupted memory when bt_xmit() is issued. The skb->cb is "released" in the return of header_create() making room for lower layer to minipulate the skb->cb. The value retrieved in bt_xmit is not persistent across header creation and sending, and the lower layer will overwrite portions of skb->cb, making the copied destination address wrong. The memory corruption will lead to non-working multicast as the first 4 bytes of the copied destination address is replaced by a value that resolves into a non-multicast prefix. This fix removes the dependency on the skb control block between header creation and send, by moving the destination address memcpy to the send function path (setup_create, which is called from bt_xmit). Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no> Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: stable@vger.kernel.org # 4.5+
Diffstat (limited to 'net/ieee802154')
0 files changed, 0 insertions, 0 deletions