Pauli Virtanen
ea46a1d217
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path ...
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
Fixes: 18722c2470
2025-12-03 12:45:16 +01:00
net/9p: fix double req put in p9_fd_cancelled
2025-10-29 13:59:54 +01:00
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-02-01 18:18:45 +01:00
net: vlan: sync VLAN features with lower device
2025-12-03 12:45:15 +01:00
net: appletalk: Fix use-after-free in AARP proxy probe
2025-08-28 16:21:17 +02:00
net: atm: fix memory leak in atm_register_sysfs when device_register fail
2025-09-09 18:43:58 +02:00
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-09 18:43:58 +02:00
batman-adv: fix OOB read/write in network-coding decode
2025-09-09 18:43:59 +02:00
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
2025-12-03 12:45:16 +01:00
bpfilter: match bit size of bpfilter_umh to that of the kernel
2025-07-17 18:24:51 +02:00
bridge: Redirect to backup port when port is administratively down
2025-12-03 12:45:09 +01:00
caif: reduce stack size, again
2025-08-28 16:21:19 +02:00
can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
2025-10-02 13:34:29 +02:00
page_pool: Clamp pool size to max 16K pages
2025-12-03 12:45:14 +01:00
net: fix data-races around sk->sk_forward_alloc
2025-02-01 18:18:52 +01:00
net: dsa: microchip: linearize skb for tail-tagging switches
2025-09-09 18:44:00 +02:00
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
2024-12-14 19:44:51 +01:00
net: When removing nexthops, don't call synchronize_net if it is not necessary
2025-12-03 12:45:10 +01:00
ipv6: np->rxpmtu race annotation
2025-12-03 12:45:13 +01:00
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-06-04 14:32:35 +02:00
wifi: mac80211: fix incorrect type for ret
2025-10-02 13:34:30 +02:00
mac802154: check local interfaces before deleting sdata list
2025-02-01 18:18:50 +01:00
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
2025-06-27 11:02:57 +01:00
net: ncsi: Fix buffer overflow in fetching version id
2025-08-28 16:21:27 +02:00
ipvs: Defer ip_vs_ftp unregister during netns cleanup
2025-10-29 13:59:49 +01:00
calipso: unlock rcu before returning -EAFNOSUPPORT
2025-06-27 11:02:50 +01:00
netlink: avoid infinite retry looping in netlink_unicast()
2025-08-28 16:21:23 +02:00
netrom: check buffer length before accessing it
2025-01-09 13:23:35 +01:00
NFC: nci: uart: Set tty->disc_data only in success path
2025-06-27 11:02:51 +01:00
openvswitch: Fix unsafe attribute parsing in output_userspace()
2025-06-04 14:32:29 +02:00
net/packet: fix a race in packet_set_ring() and packet_notifier()
2025-08-28 16:21:23 +02:00
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
2025-08-28 16:21:14 +02:00
rds: Fix endianness annotation for RDS_MPATH_HASH
2025-12-03 12:45:10 +01:00
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
2025-10-02 13:34:32 +02:00
rose: fix dangling neighbour pointers in rose_rt_device_down()
2025-07-17 18:25:00 +02:00
rxrpc: Fix oops due to non-existence of prealloc backlog struct
2025-07-17 18:25:02 +02:00
net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-12-03 12:45:04 +01:00
sctp: Prevent TOCTOU out-of-bounds write
2025-12-03 12:45:15 +01:00
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
2025-01-09 13:23:27 +01:00
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
2025-06-27 11:02:58 +01:00
tipc: Fix use-after-free in tipc_conn_close().
2025-07-17 18:25:01 +02:00
tls: don't rely on tx_work during send()
2025-10-29 13:59:57 +01:00
vsock: Do not allow binding to VMADDR_PORT_ANY
2025-08-28 16:21:23 +02:00
wifi: cfg80211: fix use-after-free in cmp_bss()
2025-09-09 18:43:56 +02:00
xfrm: Sanitize marks before insert
2025-06-04 14:32:35 +02:00
ea46a1d217