[PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

[PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

[Eric Dumazet]

The aoe driver (or similar) generates a non-IPv6 packet
(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function
(lowpan_header_create or header_create) returns early without initializing
the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header
(or setup_header) which unconditionally copies and uses the lowpan_addr_info
from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

Fixes: 4dc315e267fe ("ieee802154: 6lowpan: move transmit functionality")
Reported-by: syzbot+f13c19f75e1097abd116@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a1fd763.278b5b03.2bcf39.0049.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@datenfreihafen.org>
Cc: Miquel Raynal <miquel.raynal@bootlin.com>
---
 net/ieee802154/6lowpan/tx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
index 0c07662b44c0ca84e07c61309b6b46d37a7fdf6b..4df76ff50699ede5c187c9cca6f0cc10b19d2123 100644
--- a/net/ieee802154/6lowpan/tx.c
+++ b/net/ieee802154/6lowpan/tx.c
@@ -255,6 +255,11 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev)
 
 	pr_debug("package xmit\n");
 
+	if (skb->protocol != htons(ETH_P_IPV6)) {
+		kfree_skb(skb);
+		return NET_XMIT_DROP;
+	}
+
 	WARN_ON_ONCE(skb->len > IPV6_MIN_MTU);
 
 	/* We must take a copy of the skb before we modify/replace the ipv6
-- 
2.54.0.1013.g208068f2d8-goog

Re: [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

[Miquel Raynal]

Hi Eric,

On 03/06/2026 at 07:29:55 GMT, Eric Dumazet <edumazet@google.com> wrote:

> The aoe driver (or similar) generates a non-IPv6 packet
> (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
> on a 6LoWPAN interface (configured by the user or test case).
>
> Since the packet is not IPv6, the 6LoWPAN header_ops->create function
> (lowpan_header_create or header_create) returns early without initializing
> the lowpan_addr_info structure in the skb headroom.
>
> In the transmit function (lowpan_xmit), the driver calls lowpan_header
> (or setup_header) which unconditionally copies and uses the lowpan_addr_info
> from the headroom, which contains uninitialized data.
>
> Fix this by dropping non IPv6 packets.

I am not sure I fully grasped the syzbot report. The problem may happen
because an interface can be configured as a 6lowpan interface, which in
this case should not transmit the packet, but there are other possible
configurations which would just work and accept ETH_P_AOE packets
(whatever that is). Is this correct? If so, then this indeed looks like
the best approach,

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

But otherwise I guess this fix would totally prevent the AOE driver
from working correctly, so I just want to double check my understanding.

Thanks,
Miquèl

Re: [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

[Eric Dumazet]

On Wed, Jun 3, 2026 at 8:45 AM Miquel Raynal <miquel.raynal@bootlin.com> wrote:
>
> Hi Eric,
>
> On 03/06/2026 at 07:29:55 GMT, Eric Dumazet <edumazet@google.com> wrote:
>
> > The aoe driver (or similar) generates a non-IPv6 packet
> > (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
> > on a 6LoWPAN interface (configured by the user or test case).
> >
> > Since the packet is not IPv6, the 6LoWPAN header_ops->create function
> > (lowpan_header_create or header_create) returns early without initializing
> > the lowpan_addr_info structure in the skb headroom.
> >
> > In the transmit function (lowpan_xmit), the driver calls lowpan_header
> > (or setup_header) which unconditionally copies and uses the lowpan_addr_info
> > from the headroom, which contains uninitialized data.
> >
> > Fix this by dropping non IPv6 packets.
>
> I am not sure I fully grasped the syzbot report. The problem may happen
> because an interface can be configured as a 6lowpan interface, which in
> this case should not transmit the packet, but there are other possible
> configurations which would just work and accept ETH_P_AOE packets
> (whatever that is). Is this correct? If so, then this indeed looks like
> the best approach,
>
> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
>
> But otherwise I guess this fix would totally prevent the AOE driver
> from working correctly, so I just want to double check my understanding.
Hey Miquèl,

Yes, this is only for when the interface is configured as 6lowpan,
which implies IPv6 traffic.

If it's configured differently (e.g., for AOE), then it shouldn't be
using the 6lowpan xmit path.

Thanks.

Re: [PATCH net] ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

[Miquel Raynal]

> Hey Miquèl,
>
> Yes, this is only for when the interface is configured as 6lowpan,
> which implies IPv6 traffic.
>
> If it's configured differently (e.g., for AOE), then it shouldn't be
> using the 6lowpan xmit path.

Ok, perfect then, thanks for the fix!

Miquèl