Subject: Re: [Patch] rose_route_frame() NULL pointer dereference kernel panic

From: f6bvp <[email-masked]>
Date: Sat, 5 Mar 2016 18:32:04 +0100

Le 05/03/2016 17:22, David Miller a écrit :
> From: f6bvp <[email-masked]>
> Date: Sat, 5 Mar 2016 16:32:42 +0100
> 
>> I understand I did not explain clearly or completely things.
>>
>> I agree that each time patched rose_xmit() is calling
>> rose_route_frame() it will
>> get a 0 return.
>> And I think this is what was intended by the author of rose_xmit().
> 
> If that's what he intended he would have implemented the entirety of
> rose_xmit() as "kfree_skb(skb)".  But that's obviously not the case.
> 
> The author meant the packet to be sent in some way, perhaps using a
> default path or something like that.

Via a NULL pointer ?
I don't see how it could work.

> 
> So please stop telling me over and over again that this function
> is meant to simply drop all packets, it's not true.
> 
I am just making hypothesis and trying to infer some deductions from the
behaviour of program when there is no more kernel panic.

If there is a situation leading to a kernel panic, I thought code should
be changed ?
What is the problem replacing a NULL argument by an array of 0 ?