From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
netdev@vger.kernel.org, eric.dumazet@gmail.com,
syzbot+f13c19f75e1097abd116@syzkaller.appspotmail.com,
Alexander Aring <alex.aring@gmail.com>,
Stefan Schmidt <stefan@datenfreihafen.org>
Subject: Re: [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
Date: Wed, 03 Jun 2026 17:45:25 +0200 [thread overview]
Message-ID: <87h5njzkyy.fsf@bootlin.com> (raw)
In-Reply-To: <20260603072955.4032221-1-edumazet@google.com> (Eric Dumazet's message of "Wed, 3 Jun 2026 07:29:55 +0000")
Hi Eric,
On 03/06/2026 at 07:29:55 GMT, Eric Dumazet <edumazet@google.com> wrote:
> The aoe driver (or similar) generates a non-IPv6 packet
> (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
> on a 6LoWPAN interface (configured by the user or test case).
>
> Since the packet is not IPv6, the 6LoWPAN header_ops->create function
> (lowpan_header_create or header_create) returns early without initializing
> the lowpan_addr_info structure in the skb headroom.
>
> In the transmit function (lowpan_xmit), the driver calls lowpan_header
> (or setup_header) which unconditionally copies and uses the lowpan_addr_info
> from the headroom, which contains uninitialized data.
>
> Fix this by dropping non IPv6 packets.
I am not sure I fully grasped the syzbot report. The problem may happen
because an interface can be configured as a 6lowpan interface, which in
this case should not transmit the packet, but there are other possible
configurations which would just work and accept ETH_P_AOE packets
(whatever that is). Is this correct? If so, then this indeed looks like
the best approach,
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
But otherwise I guess this fix would totally prevent the AOE driver
from working correctly, so I just want to double check my understanding.
Thanks,
Miquèl
next prev parent reply other threads:[~2026-06-03 15:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-03 7:29 [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() Eric Dumazet
2026-06-03 15:45 ` Miquel Raynal [this message]
2026-06-03 15:57 ` Eric Dumazet
2026-06-03 16:04 ` Miquel Raynal
2026-06-04 16:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87h5njzkyy.fsf@bootlin.com \
--to=miquel.raynal@bootlin.com \
--cc=alex.aring@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stefan@datenfreihafen.org \
--cc=syzbot+f13c19f75e1097abd116@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.