1. 15 Nov, 2013 2 commits
    • Jukka Rissanen's avatar
      6lowpan: Uncompression of traffic class field was incorrect · 1188f054
      Jukka Rissanen authored
      If priority/traffic class field in IPv6 header is set (seen when
      using ssh), the uncompression sets the TC and Flow fields incorrectly.
      
      Example:
      
      This is IPv6 header of a sent packet. Note the priority/TC (=1) in
      the first byte.
      
      00000000: 61 00 00 00 00 2c 06 40 fe 80 00 00 00 00 00 00
      00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
      00000020: 02 1e ab ff fe 4c 52 57
      
      This gets compressed like this in the sending side
      
      00000000: 72 31 04 06 02 1e ab ff fe 4c 52 57 ec c2 00 16
      00000010: aa 2d fe 92 86 4e be c6 ....
      
      In the receiving end, the packet gets uncompressed to this
      IPv6 header
      
      00000000: 60 06 06 02 00 2a 1e 40 fe 80 00 00 00 00 00 00
      00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
      00000020: ab ff fe 4c 52 57 ec c2
      
      First four bytes are set incorrectly and we have also lost
      two bytes from destination address.
      
      The fix is to switch the case values in switch statement
      when checking the TC field.
      Signed-off-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1188f054
    • Erik Hugne's avatar
      tipc: fix dereference before check warning · 3db0a197
      Erik Hugne authored
      This fixes the following Smatch warning:
      net/tipc/link.c:2364 tipc_link_recv_fragment()
          warn: variable dereferenced before check '*head' (see line 2361)
      
      A null pointer might be passed to skb_try_coalesce if
      a malicious sender injects orphan fragments on a link.
      Signed-off-by: default avatarErik Hugne <erik.hugne@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3db0a197
  2. 14 Nov, 2013 38 commits