Patch "Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets" has been added to the 4.4-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 Mon Sep 17 00:00:00 2001
From: Lukasz Duda <lukasz.duda@nordicsemi.no>
Date: Wed, 13 Jan 2016 16:57:48 +0100
Subject: Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets

From: Lukasz Duda <lukasz.duda@nordicsemi.no>

commit 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 upstream.

This patch fixes incorrect handling of the 6lowpan packets that contain
uncompressed IPv6 header.

RFC4944 specifies a special dispatch for 6lowpan to carry uncompressed
IPv6 header. This dispatch (1 byte long) has to be removed during
reception and skb data pointer has to be moved. To correctly point in
the beginning of the IPv6 header the dispatch byte has to be pulled off
before packet can be processed by netif_rx_in().

Test scenario: IPv6 packets are not correctly interpreted by the network
layer when IPv6 header is not compressed (e.g. ICMPv6 Echo Reply is not
propagated correctly to the ICMPv6 layer because the extra byte will make
the header look corrupted).

Similar approach is done for IEEE 802.15.4.

Signed-off-by: Lukasz Duda <lukasz.duda@nordicsemi.no>
Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/6lowpan.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb,
 
 	/* check that it's our buffer */
 	if (lowpan_is_ipv6(*skb_network_header(skb))) {
+		/* Pull off the 1-byte of 6lowpan header. */
+		skb_pull(skb, 1);
+
 		/* Copy the packet so that the IPv6 header is
 		 * properly aligned.
 		 */


Patches currently in stable-queue which might be from lukasz.duda@nordicsemi.no are

queue-4.4/bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch
queue-4.4/bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch