Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-06 Thread f6bvp
François, Thank you for providing information about rose_rebuild_header history. I was not able to find Jonathan Naylor G4KLX email. However as rose_xmit() has been recently changed by Eric Biederman, he may have more precise information about rose_route_frame() NULL argument. Meanwhile, I browse

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-05 Thread Francois Romieu
f6bvp : > Le 05/03/2016 17:22, David Miller a écrit : [...] > > If that's what he intended he would have implemented the entirety of > > rose_xmit() as "kfree_skb(skb)". But that's obviously not the case. > > > > The author meant the packet to be sent in some way, perhaps using a > > default pat

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-05 Thread f6bvp
Le 05/03/2016 17:22, David Miller a écrit : > From: f6bvp > Date: Sat, 5 Mar 2016 16:32:42 +0100 > >> I understand I did not explain clearly or completely things. >> >> I agree that each time patched rose_xmit() is calling >> rose_route_frame() it will >> get a 0 return. >> And I think this is

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-05 Thread David Miller
From: f6bvp Date: Sat, 5 Mar 2016 16:32:42 +0100 > I understand I did not explain clearly or completely things. > > I agree that each time patched rose_xmit() is calling > rose_route_frame() it will > get a 0 return. > And I think this is what was intended by the author of rose_xmit(). If that'

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-05 Thread f6bvp
David, I understand I did not explain clearly or completely things. I agree that each time patched rose_xmit() is calling rose_route_frame() it will get a 0 return. And I think this is what was intended by the author of rose_xmit(). He wrote a null argument in order to obtain this result but t

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-03 Thread David Miller
From: f6bvp Date: Tue, 1 Mar 2016 21:37:14 +0100 > I built the following patch in order to obtain the same result without > NULL pointer. But it will cause every packet to be dropped because rose_route_frame() won't find a matching neighbour, and therefore return 0 to rose_xmit().

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-03-01 Thread f6bvp
Hi David, Ralf, David is absolutely right about my unappropriate patch. Although I had searched functions calling rose_route_frame(), I did not notice rose_xmit() was involved. Shame on me ! Then, David precisely located the source of the issue we are facing. When rose_xmit() calls rose_route_f

Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-02-25 Thread David Miller
From: f6bvp Date: Wed, 24 Feb 2016 17:53:11 +0100 > @@ -863,6 +863,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb > *ax25) First of all this patch was corrupted by your email client. > int res = 0; > char buf[11]; > > + if (ax25 == NULL) { > + print

[Patch] rose_route_frame() NULL pointer dereference kernel panic

2016-02-24 Thread f6bvp
[Patch] Null pointer in rose_route_frame() Bug appears when setting a second IP to ethernet device without adding a route and a gateway: /sbin/ifconfig enp4s0:1 44.168.19.22 netmask 255.255.255.240 If a route and a gateway are not added for subnet, and if ax25ipd configuration includes a destin