Re: [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

On Wed, Jun 3, 2026 at 8:45 AM Miquel Raynal [off-list ref] wrote:

Hi Eric,

On 03/06/2026 at 07:29:55 GMT, Eric Dumazet [off-list ref] wrote:

quoted

The aoe driver (or similar) generates a non-IPv6 packet
(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function
(lowpan_header_create or header_create) returns early without initializing
the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header
(or setup_header) which unconditionally copies and uses the lowpan_addr_info
from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

I am not sure I fully grasped the syzbot report. The problem may happen
because an interface can be configured as a 6lowpan interface, which in
this case should not transmit the packet, but there are other possible
configurations which would just work and accept ETH_P_AOE packets
(whatever that is). Is this correct? If so, then this indeed looks like
the best approach,

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

But otherwise I guess this fix would totally prevent the AOE driver
from working correctly, so I just want to double check my understanding.

Hey Miquèl,

Yes, this is only for when the interface is configured as 6lowpan,
which implies IPv6 traffic.

If it's configured differently (e.g., for AOE), then it shouldn't be
using the 6lowpan xmit path.

Thanks.