Skip to content

Commit

Permalink
gnrc_sixlowpan_nd: fixed crash on gnrc_sixlowpan_nd_next_hop_l2addr.
Browse files Browse the repository at this point in the history
When `gnrc_ndp_node_next_hop_l2addr` cannot resolve L2 address, it creates a
temporary neighbor cache entry with interface `KERNEL_PID_UNDEF` (unless the
interface is already known) to send a neighbor solicitation. When another packet
directed to the same address is going to sent before receiving a neighbor
advertisement, `gnrc_sixlowpan_nd_next_hop_l2addr` gets the temporary neighbor
cache entry and calls `gnrc_ipv6_netif_get` with `KERNEL_PID_UNDEF`, resulting
get a `NULL`. We must check `NULL` before dereference it.

FYI, both `gnrc_ndp_node_next_hop_l2addr` and
`gnrc_sixlowpan_nd_next_hop_l2addr` are enabled when
`gnrc_sixlowpan_border_router_default` module is enabled with `GNRC_NETIF_NUMOF`
is greater than 1:

gnrc_sixlowpan_border_router_default
→ gnrc_ipv6_router_default
→ gnrc_ndp_router (if GNRC_NETIF_NUMOF > 1)
→ gnrc_ndp_node
→ gnrc_ndp_node_next_hop_l2addr is called from _next_hop_l2addr

gnrc_sixlowpan_border_router_default
→ gnrc_sixlowpan_nd_border_router
→ gnrc_sixlowpan_nd_router
→ gnrc_sixlowpan_nd
→ gnrc_sixlowpan_nd_next_hop_l2addr is called from _next_hop_l2addr
  • Loading branch information
Yonezawa-T2 committed Dec 9, 2015
1 parent a87d36a commit b0e9c40
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ kernel_pid_t gnrc_sixlowpan_nd_next_hop_l2addr(uint8_t *l2addr, uint8_t *l2addr_
if (nc_entry != NULL) {
gnrc_ipv6_netif_t *ipv6_if = gnrc_ipv6_netif_get(nc_entry->iface);
/* and interface is not 6LoWPAN */
if (!(ipv6_if->flags & GNRC_IPV6_NETIF_FLAGS_SIXLOWPAN) ||
if (!(ipv6_if == NULL || ipv6_if->flags & GNRC_IPV6_NETIF_FLAGS_SIXLOWPAN) ||
/* or entry is registered */
(gnrc_ipv6_nc_get_type(nc_entry) == GNRC_IPV6_NC_TYPE_REGISTERED)) {
next_hop = dst;
Expand Down

0 comments on commit b0e9c40

Please sign in to comment.