Skip to content

Commit d4787a1

Browse files
tcheneaudavem330
authored andcommitted
6lowpan: Fix null pointer dereference in UDP uncompression function
When a UDP packet gets fragmented, a crash will occur at reassembly time. This is because skb->transport_header is not set during earlier period of fragment reassembly. As a consequence, call to udp_hdr() return NULL and uh (which is NULL) gets dereferenced without much test. Signed-off-by: Tony Cheneau <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 6e5928f commit d4787a1

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

net/ieee802154/6lowpan.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,9 @@ lowpan_uncompress_udp_header(struct sk_buff *skb)
314314
struct udphdr *uh = udp_hdr(skb);
315315
u8 tmp;
316316

317+
if (!uh)
318+
goto err;
319+
317320
if (lowpan_fetch_skb_u8(skb, &tmp))
318321
goto err;
319322

0 commit comments

Comments
 (0)