linux-hardened/net/6lowpan
Michael Scott 03bc05e1a4 6lowpan: iphc: reset mac_header after decompress to fix panic
After decompression of 6lowpan socket data, an IPv6 header is inserted
before the existing socket payload.  After this, we reset the
network_header value of the skb to account for the difference in payload
size from prior to decompression + the addition of the IPv6 header.

However, we fail to reset the mac_header value.

Leaving the mac_header value untouched here, can cause a calculation
error in net/packet/af_packet.c packet_rcv() function when an
AF_PACKET socket is opened in SOCK_RAW mode for use on a 6lowpan
interface.

On line 2088, the data pointer is moved backward by the value returned
from skb_mac_header().  If skb->data is adjusted so that it is before
the skb->head pointer (which can happen when an old value of mac_header
is left in place) the kernel generates a panic in net/core/skbuff.c
line 1717.

This panic can be generated by BLE 6lowpan interfaces (such as bt0) and
802.15.4 interfaces (such as lowpan0) as they both use the same 6lowpan
sources for compression and decompression.

Signed-off-by: Michael Scott <michael@opensourcefoundries.com>
Acked-by: Alexander Aring <aring@mojatatu.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2018-07-06 12:32:12 +02:00
..
6lowpan_i.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
core.c 6lowpan: Don't set IFF_NO_QUEUE 2017-04-12 22:02:40 +02:00
debugfs.c 6lowpan: add support for getting short address 2016-06-15 20:41:24 -07:00
iphc.c 6lowpan: iphc: reset mac_header after decompress to fix panic 2018-07-06 12:32:12 +02:00
Kconfig 6lowpan: add debugfs support 2015-12-10 01:25:25 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ndisc.c 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
nhc.c 6lowpan: use rb_entry() 2017-01-22 16:46:13 -05:00
nhc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nhc_dest.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_fragment.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_ghc_ext_dest.c 6lowpan: add nhc module for GHC destination extension header detection 2015-12-10 01:25:25 +01:00
nhc_ghc_ext_frag.c 6lowpan: add nhc module for GHC fragmentation extension header detection 2015-12-10 01:25:25 +01:00
nhc_ghc_ext_hop.c 6lowpan: add nhc module for GHC hop-by-hopextension header detection 2015-12-10 01:25:24 +01:00
nhc_ghc_ext_route.c 6lowpan: add nhc module for GHC routing extension header detection 2015-12-10 01:25:25 +01:00
nhc_ghc_icmpv6.c 6lowpan: add nhc module for GHC ICMPv6 detection 2015-12-10 01:25:24 +01:00
nhc_ghc_udp.c 6lowpan: add nhc module for GHC UDP detection 2015-12-10 01:25:24 +01:00
nhc_hop.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_ipv6.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_mobility.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_routing.c 6lowpan: nhc: add other known rfc6282 compressions 2015-02-14 23:08:44 +01:00
nhc_udp.c 6lowpan: change naming for lowpan private data 2016-04-13 10:41:09 +02:00