[PATCH net 1/2] ieee802154: 6lowpan: look up the neighbour short address in lowpan_xmit()
From: Eric Dumazet <edumazet@kernel.org>
Date: 2026-09-28 18:37:59
Subsystem:
ieee 802.15.4 subsystem, networking [general], the rest · Maintainers:
Alexander Aring, Stefan Schmidt, Miquel Raynal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
lowpan_header_create() uses ipv6_hdr(skb)->daddr to find the
neighbour, and to use its 802.15.4 short address if it has one.
The IPv6 header is not there yet when lowpan_header_create() is
called for AF_PACKET SOCK_DGRAM sockets: packet_snd() copies the
payload after dev_hard_header(), and tpacket_fill_skb() attaches it
as page fragments after dev_hard_header(). The lookup then reads
uninitialized memory, possibly past the end of the linear data.
Move the lookup to lowpan_header(), called from lowpan_xmit().
lowpan_xmit() now makes sure the IPv6 header is in the linear part
of the skb, and resets the network header, since AF_PACKET SOCK_RAW
sockets set it after dev->hard_header_len bytes.
lowpan_header_compress() expects the IPv6 header at skb->data.
Fixes: eab560e58208 ("6lowpan: add support for 802.15.4 short addr handling")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Alexander Aring <alex.aring@gmail.com>
---
net/ieee802154/6lowpan/tx.c | 63 ++++++++++++++++++++++---------------
1 file changed, 37 insertions(+), 26 deletions(-)
diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
index 4df76ff50699ede5c187c9cca6f0cc10b19d2123..2d83a810e610845dc0476ed3f12a6479841c8819 100644
--- a/net/ieee802154/6lowpan/tx.c
+++ b/net/ieee802154/6lowpan/tx.c@@ -36,9 +36,6 @@ int lowpan_header_create(struct sk_buff *skb, struct net_device *ldev, { struct wpan_dev *wpan_dev = lowpan_802154_dev(ldev)->wdev->ieee802154_ptr; struct lowpan_addr_info *info = lowpan_skb_priv(skb); - struct lowpan_802154_neigh *llneigh = NULL; - const struct ipv6hdr *hdr = ipv6_hdr(skb); - struct neighbour *n; if (!daddr) return -EINVAL;
@@ -57,28 +54,12 @@ int lowpan_header_create(struct sk_buff *skb, struct net_device *ldev, info->daddr.short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST); info->daddr.mode = IEEE802154_ADDR_SHORT; } else { - __le16 short_addr = cpu_to_le16(IEEE802154_ADDR_SHORT_UNSPEC); - - n = neigh_lookup(&nd_tbl, &hdr->daddr, ldev); - if (n) { - llneigh = lowpan_802154_neigh(neighbour_priv(n)); - read_lock_bh(&n->lock); - short_addr = llneigh->short_addr; - read_unlock_bh(&n->lock); - } - - if (llneigh && - lowpan_802154_is_valid_src_short_addr(short_addr)) { - info->daddr.short_addr = short_addr; - info->daddr.mode = IEEE802154_ADDR_SHORT; - } else { - info->daddr.mode = IEEE802154_ADDR_LONG; - ieee802154_be64_to_le64(&info->daddr.extended_addr, - daddr); - } - - if (n) - neigh_release(n); + /* The IPv6 header might not be there yet (AF_PACKET). + * lowpan_header() will use the neighbour short address, + * if there is one. + */ + info->daddr.mode = IEEE802154_ADDR_LONG; + ieee802154_be64_to_le64(&info->daddr.extended_addr, daddr); } if (!saddr) {
@@ -221,6 +202,31 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *ldev, return rc; } +/* Use the short address of the IPv6 destination, if the neighbour has one. */ +static void lowpan_neigh_short_addr(const struct sk_buff *skb, + struct net_device *ldev, + struct ieee802154_addr *daddr) +{ + struct lowpan_802154_neigh *llneigh; + struct neighbour *n; + __le16 short_addr; + + n = neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->daddr, ldev); + if (!n) + return; + + llneigh = lowpan_802154_neigh(neighbour_priv(n)); + read_lock_bh(&n->lock); + short_addr = llneigh->short_addr; + read_unlock_bh(&n->lock); + neigh_release(n); + + if (lowpan_802154_is_valid_src_short_addr(short_addr)) { + daddr->short_addr = short_addr; + daddr->mode = IEEE802154_ADDR_SHORT; + } +} + static int lowpan_header(struct sk_buff *skb, struct net_device *ldev, u16 *dgram_size, u16 *dgram_offset) {
@@ -230,6 +236,9 @@ static int lowpan_header(struct sk_buff *skb, struct net_device *ldev, memcpy(&info, lowpan_skb_priv(skb), sizeof(info)); + if (info.daddr.mode == IEEE802154_ADDR_LONG) + lowpan_neigh_short_addr(skb, ldev, &info.daddr); + *dgram_size = skb->len; lowpan_header_compress(skb, ldev, &info.daddr, &info.saddr); /* dgram_offset = (saved bytes after compression) + lowpan header len */
@@ -255,10 +264,12 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev) pr_debug("package xmit\n"); - if (skb->protocol != htons(ETH_P_IPV6)) { + if (skb->protocol != htons(ETH_P_IPV6) || + !pskb_may_pull(skb, sizeof(struct ipv6hdr))) { kfree_skb(skb); return NET_XMIT_DROP; } + skb_reset_network_header(skb); WARN_ON_ONCE(skb->len > IPV6_MIN_MTU);
--
2.56.0.rc1.315.gc6ed9934b7-goog