1. 26 Apr, 2016 38 commits
  2. 25 Apr, 2016 2 commits
    • Glenn Ruben Bakke's avatar
      Bluetooth: 6lowpan: Fix memory corruption of ipv6 destination address · 55441070
      Glenn Ruben Bakke authored
      The memcpy of ipv6 header destination address to the skb control block
      (sbk->cb) in header_create() results in currupted memory when bt_xmit()
      is issued. The skb->cb is "released" in the return of header_create()
      making room for lower layer to minipulate the skb->cb.
      
      The value retrieved in bt_xmit is not persistent across header creation
      and sending, and the lower layer will overwrite portions of skb->cb,
      making the copied destination address wrong.
      
      The memory corruption will lead to non-working multicast as the first 4
      bytes of the copied destination address is replaced by a value that
      resolves into a non-multicast prefix.
      
      This fix removes the dependency on the skb control block between header
      creation and send, by moving the destination address memcpy to the send
      function path (setup_create, which is called from bt_xmit).
      Signed-off-by: default avatarGlenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
      Acked-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Cc: stable@vger.kernel.org # 4.5+
      55441070
    • David S. Miller's avatar
      Merge branch 'pskb_extract' · 5a5f0792
      David S. Miller authored
      Sowmini Varadhan says:
      
      ====================
      pskb_extract() helper function.
      
      This patchset follows up on the discussion in
       https://www.mail-archive.com/netdev@vger.kernel.org/msg105090.html
      
      For RDS-TCP, we have to deal with the full gamut of
      nonlinear sk_buffs, including all the frag_list variants.
      Also, the parent skb has to remain unchanged, while the clone
      is queued for Rx on the PF_RDS socket.
      
      Patch 1 of this patchset adds a pskb_extract() function that
      does all this without the redundant memcpy's in pskb_expand_head()
      and __pskb_pull_tail().
      
      v2: Marcelo Leitner review comments
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5a5f0792