Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24641fb6 authored by Alexander Aring's avatar Alexander Aring Committed by Greg Kroah-Hartman
Browse files

net: ieee802154: 6lowpan: fix frag reassembly 



commit f18fa5de5ba7f1d6650951502bb96a6e4715a948 upstream.

This patch initialize stack variables which are used in
frag_lowpan_compare_key to zero. In my case there are padding bytes in the
structures ieee802154_addr as well in frag_lowpan_compare_key. Otherwise
the key variable contains random bytes. The result is that a compare of
two keys by memcmp works incorrect.

Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: default avatarAlexander Aring <aring@mojatatu.com>
Reported-by: default avatarStefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: default avatarStefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 49310710

net/ieee802154/6lowpan/6lowpan_i.h

+2 −2
Original line number Diff line number Diff line
@@ -19,8 +19,8 @@ typedef unsigned __bitwise__ lowpan_rx_result; 
struct frag_lowpan_compare_key {

	u16 tag;

	u16 d_size;

	const struct ieee802154_addr src;

	const struct ieee802154_addr dst;

	struct ieee802154_addr src;

	struct ieee802154_addr dst;

};



/* Equivalent of ipv4 struct ipq

net/ieee802154/6lowpan/reassembly.c

+7 −7
Original line number Diff line number Diff line
@@ -74,14 +74,14 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb, 
{

	struct netns_ieee802154_lowpan *ieee802154_lowpan =

		net_ieee802154_lowpan(net);

	struct frag_lowpan_compare_key key = {

		.tag = cb->d_tag,

		.d_size = cb->d_size,

		.src = *src,

		.dst = *dst,

	};

	struct frag_lowpan_compare_key key = {};

	struct inet_frag_queue *q;



	key.tag = cb->d_tag;

	key.d_size = cb->d_size;

	key.src = *src;

	key.dst = *dst;



	q = inet_frag_find(&ieee802154_lowpan->frags, &key);

	if (IS_ERR_OR_NULL(q)) {

		inet_frag_maybe_warn_overflow(q, pr_fmt());
@@ -372,7 +372,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) 
	struct lowpan_frag_queue *fq;

	struct net *net = dev_net(skb->dev);

	struct lowpan_802154_cb *cb = lowpan_802154_cb(skb);

	struct ieee802154_hdr hdr;

	struct ieee802154_hdr hdr = {};

	int err;



	if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)