leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: ieee802154: 6lowpan: fix frag reassembly

Browse Source 
This patch initialize stack variables which are used in
frag_lowpan_compare_key to zero. In my case there are padding bytes in the
structures ieee802154_addr as well in frag_lowpan_compare_key. Otherwise
the key variable contains random bytes. The result is that a compare of
two keys by memcmp works incorrect.

Fixes: 648700f76b ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: Alexander Aring <aring@mojatatu.com>
Reported-by: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
This commit is contained in:
Alexander Aring 2018-04-20 14:54:13 -04:00 committed by Stefan Schmidt
parent 7e0ffee1b2
commit f18fa5de5b
2 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/ieee802154/6lowpan/6lowpan_i.h
View File

@ -20,8 +20,8 @@ typedef unsigned __bitwise lowpan_rx_result;
struct frag_lowpan_compare_key { struct frag_lowpan_compare_key {
u16 tag; u16 tag;
u16 d_size; u16 d_size;
const struct ieee802154_addr src; struct ieee802154_addr src;
const struct ieee802154_addr dst; struct ieee802154_addr dst;
}; };
/* Equivalent of ipv4 struct ipq /* Equivalent of ipv4 struct ipq

14
net/ieee802154/6lowpan/reassembly.c
View File

@ -75,14 +75,14 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb,
{ {
struct netns_ieee802154_lowpan *ieee802154_lowpan = struct netns_ieee802154_lowpan *ieee802154_lowpan =
net_ieee802154_lowpan(net); net_ieee802154_lowpan(net);
struct frag_lowpan_compare_key key = { struct frag_lowpan_compare_key key = {};
.tag = cb->d_tag,
.d_size = cb->d_size,
.src = *src,
.dst = *dst,
};
struct inet_frag_queue *q; struct inet_frag_queue *q;
key.tag = cb->d_tag;
key.d_size = cb->d_size;
key.src = *src;
key.dst = *dst;
q = inet_frag_find(&ieee802154_lowpan->frags, &key); q = inet_frag_find(&ieee802154_lowpan->frags, &key);
if (!q) if (!q)
return NULL; return NULL;
@ -372,7 +372,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type)
struct lowpan_frag_queue *fq; struct lowpan_frag_queue *fq;
struct net *net = dev_net(skb->dev); struct net *net = dev_net(skb->dev);
struct lowpan_802154_cb *cb = lowpan_802154_cb(skb); struct lowpan_802154_cb *cb = lowpan_802154_cb(skb);
struct ieee802154_hdr hdr; struct ieee802154_hdr hdr = {};
int err; int err;
if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)