diff options
| author | Daniel Borkmann <dborkman@redhat.com> | 2014-01-06 01:45:50 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-01-05 20:25:24 -0500 |
| commit | 965801e1eb624154fe5e9dc5d2ff0b7f1951a11c (patch) | |
| tree | ba08d2d9cde29f57f77b466fee04fdf1f071d2e8 /net | |
| parent | 7d30622dbe64a7207af8a98f48d4a4ef00ab658a (diff) | |
| download | linux-965801e1eb624154fe5e9dc5d2ff0b7f1951a11c.tar.gz linux-965801e1eb624154fe5e9dc5d2ff0b7f1951a11c.tar.bz2 linux-965801e1eb624154fe5e9dc5d2ff0b7f1951a11c.zip | |
net: 6lowpan: fix lowpan_header_create non-compression memcpy call
In function lowpan_header_create(), we invoke the following code
construct:
struct ipv6hdr *hdr;
...
hdr = ipv6_hdr(skb);
...
if (...)
memcpy(hc06_ptr + 1, &hdr->flow_lbl[1], 2);
else
memcpy(hc06_ptr, &hdr, 4);
Where the else path of the condition, that is, non-compression
path, calls memcpy() with a pointer to struct ipv6hdr *hdr as
source, thus two levels of indirection. This cannot be correct,
and likely only one level of pointer was intended as source
buffer for memcpy() here.
Fixes: 44331fe2aa0d ("IEEE802.15.4: 6LoWPAN basic support")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Cc: Werner Almesberger <werner@almesberger.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ieee802154/6lowpan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index 459e200c08a4..a2d2456a557a 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c @@ -547,7 +547,7 @@ static int lowpan_header_create(struct sk_buff *skb, hc06_ptr += 3; } else { /* compress nothing */ - memcpy(hc06_ptr, &hdr, 4); + memcpy(hc06_ptr, hdr, 4); /* replace the top byte with new ECN | DSCP format */ *hc06_ptr = tmp; hc06_ptr += 4; |