[PATCH] net: iphc: fix offset errors in multicast context compression

[PATCH] net: iphc: fix offset errors in multicast context compression

[Quan Sun]

The function lowpan_iphc_mcast_ctx_addr_compress() contains two offset
errors that break context-based multicast address compression
(LOWPAN_IPHC_DAM_00).

When compressing the multicast address, the compressed format expects
exactly 6 bytes:
  - Bytes 0-1: Flags, scope, and reserved bits (from s6_addr[1..2])
  - Bytes 2-5: The 4-byte Group ID (from s6_addr[12..15])

Currently, the memcpy() operations use incorrect offsets:
1. The destination offset for the Group ID is &data[1] instead of
   &data[2]. This overwrites the previously copied scope byte.
2. The source offset for the Group ID is &ipaddr->s6_addr[11] instead
   of &ipaddr->s6_addr[12].

This mismatch results in a corrupted compressed address being
transmitted. Consequently, the receiving side fails to reconstruct the
original IPv6 address via lowpan_uncompress_multicast_ctx_daddr() since
it expects the Group ID to start at data[2].

Fix the logic by correcting both the destination and source offsets
so that the 6-byte compressed representation is assembled correctly.

Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>
---
 net/6lowpan/iphc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
index e116d308a8df6..29ae68ca3ec15 100644
--- a/net/6lowpan/iphc.c
+++ b/net/6lowpan/iphc.c
@@ -1091,7 +1091,7 @@ static u8 lowpan_iphc_mcast_ctx_addr_compress(u8 **hc_ptr,
 	/* flags/scope, reserved (RIID) */
 	memcpy(data, &ipaddr->s6_addr[1], 2);
 	/* group ID */
-	memcpy(&data[1], &ipaddr->s6_addr[11], 4);
+	memcpy(&data[2], &ipaddr->s6_addr[12], 4);
 	lowpan_push_hc_data(hc_ptr, data, 6);
 
 	return LOWPAN_IPHC_DAM_00;

base-commit: 95084f1883a760e0d4290698346759d58e2b944a
-- 
2.43.0

Re: [PATCH] net: iphc: fix offset errors in multicast context compression

[Simon Horman]

On Wed, May 06, 2026 at 12:31:46AM +0800, Quan Sun wrote:
> The function lowpan_iphc_mcast_ctx_addr_compress() contains two offset
> errors that break context-based multicast address compression
> (LOWPAN_IPHC_DAM_00).
> 
> When compressing the multicast address, the compressed format expects
> exactly 6 bytes:
>   - Bytes 0-1: Flags, scope, and reserved bits (from s6_addr[1..2])
>   - Bytes 2-5: The 4-byte Group ID (from s6_addr[12..15])
> 
> Currently, the memcpy() operations use incorrect offsets:
> 1. The destination offset for the Group ID is &data[1] instead of
>    &data[2]. This overwrites the previously copied scope byte.
> 2. The source offset for the Group ID is &ipaddr->s6_addr[11] instead
>    of &ipaddr->s6_addr[12].
> 
> This mismatch results in a corrupted compressed address being
> transmitted. Consequently, the receiving side fails to reconstruct the
> original IPv6 address via lowpan_uncompress_multicast_ctx_daddr() since
> it expects the Group ID to start at data[2].
> 
> Fix the logic by correcting both the destination and source offsets
> so that the 6-byte compressed representation is assembled correctly.

Thanks,

This matches my understanding of:

RFC 6382 Compression Format for IPv6 Datagrams over IEEE 802.15.4-Based Networks
-> Section  3.2.4. Stateful Multicast Address Compression
   https://www.rfc-editor.org/rfc/rfc6282#section-3.2.4

And it's reference to 

RFC 3306 Unicast-Prefix-based IPv6 Multicast Addresses
-> Section 4. Multicast Address Format
   https://www.rfc-editor.org/rfc/rfc3306#section-4

RFC 6382 is referred to by
RFC 6775 Neighbor Discovery Optimization for IPv6 over Low-Power Wireless
         Personal Area Networks (6LoWPANs)
- https://www.rfc-editor.org/rfc/rfc6775.html

Which is in turn referred to by
RFC 8138 IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN)
         Routing Header
-> Section 4.3.  Compressing Addresses
   https://www.rfc-editor.org/rfc/rfc8138.html#section-4.3


> Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn>

As a fix this should have a fixes tag.
I think this one is appropriate.

Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")

I don't think you need to repost because of this, but for future reference,
fixes for Networking code present in the net tree should be targeted at
that tree. This includes making sure the patch applies to that tree
(I assume this one does) and including net, as opposed to net-next,
in the patch subject like this:

Subject: [PATCH net] ...

Also, as a fix this probably waranted being CCed to stable.

For more information on Networking development process please see
https://docs.kernel.org/process/maintainer-netdev.html

The last two points not withstanding, this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

...