From patchwork Wed Jul 11 07:22:47 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: alex.bluesman.smirnov@gmail.com X-Patchwork-Id: 170381 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id B6E1E2C01B4 for ; Wed, 11 Jul 2012 17:27:12 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932104Ab2GKH1I (ORCPT ); Wed, 11 Jul 2012 03:27:08 -0400 Received: from mail-we0-f174.google.com ([74.125.82.174]:56445 "EHLO mail-we0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756420Ab2GKH1G (ORCPT ); Wed, 11 Jul 2012 03:27:06 -0400 Received: by mail-we0-f174.google.com with SMTP id x8so656595wey.19 for ; Wed, 11 Jul 2012 00:27:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=qnBaWUu9QYrDGdyhhdiEJJ4cKLPKGpN+DruJu77SXQg=; b=kEifMukts2UfGGgykJ7R9FXFj8ReRznUPcdnmzjBrQiUyGR/Lp714dMf8gU3tY1aw8 uhYguWzEz/mIgGk6ogfkOebKTjAGpyFL5320Hh/tJ7iXxnKgbPsFPeMlaMy6IWV2dqfh HpNujlZtdRrUi4JgxZKlj49aXRFVrxg6GMnlzypu8zYCtBJsJ/0Gx+sfaQ/lmQmHYaCd 0nE/KPkPoSaSx/PmFOWcXVJQvyeLiqVQ8gzH1j1ZC92+FdVCnQ2JomN7JNGPLf4wliIh QG1+I5BexxhZer6cF9BkJZ6FrjfmJb+lJa0EKk7Ihe9kLM2OdU0P0KBLvr7dZt9P5iyC R2fg== Received: by 10.180.100.131 with SMTP id ey3mr44640449wib.15.1341991626049; Wed, 11 Jul 2012 00:27:06 -0700 (PDT) Received: from localhost.localdomain ([91.213.169.4]) by mx.google.com with ESMTPS id t7sm3040238wix.6.2012.07.11.00.27.03 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 11 Jul 2012 00:27:05 -0700 (PDT) From: Alexander Smirnov To: davem@davemloft.net, eric.dumazet@gmail.com Cc: netdev@vger.kernel.org, Alexander Smirnov , Tony Cheneau Subject: [PATCH net-next v2 6/7] 6lowpan: fix tag variable size Date: Wed, 11 Jul 2012 11:22:47 +0400 Message-Id: <1341991368-11800-7-git-send-email-alex.bluesman.smirnov@gmail.com> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <1341991368-11800-1-git-send-email-alex.bluesman.smirnov@gmail.com> References: <1341991368-11800-1-git-send-email-alex.bluesman.smirnov@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Function lowpan_alloc_new_frame() takes u8 tag as an argument. However, its only caller, lowpan_process_data() passes down a u16. Hence, the tag value can get corrupted. This prevent 6lowpan fragment reassembly of a message when the fragment tag value is over 256. Signed-off-by: Alexander Smirnov Cc: Tony Cheneau --- net/ieee802154/6lowpan.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index ae3f4eb..2e790fb 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c @@ -646,7 +646,7 @@ static void lowpan_fragment_timer_expired(unsigned long entry_addr) } static struct lowpan_fragment * -lowpan_alloc_new_frame(struct sk_buff *skb, u8 iphc0, u8 len, u8 tag) +lowpan_alloc_new_frame(struct sk_buff *skb, u8 iphc0, u8 len, u16 tag) { struct lowpan_fragment *frame;