Re: [CHECKER] 84 bugs in 2.4.4/2.4.4-ac8 where NULL pointers are deref'd

From: Steve Whitehouse (steve@gw.chygwyn.com)
Date: Tue May 29 2001 - 17:56:10 EST


Hi,

>
>
> [ Steve: Just skim down to the decnet bug, you should have a look
> at it.
>
[various bits deleted]

Thanks for pointing this out. At first glance the problem is not where the
error says that it is since it should be impossible to get here with a NULL
neighbour cache entry (well we shouldn't be creating an output route without
a next hop :-)

I've got some other little DECnet fixes to forward shortly, but I'm probably
not going to get a chance to do so before the end of the week now so I'll
look at this properly and send fixes then,

Steve.

[DECnet bug report reproduced here for context]
> > ---------------------------------------------------------
> > [BUG] contradicts
> > /u2/engler/mc/oses/linux/2.4.4/net/decnet/dn_route.c:808:dn_route_output_slow: ERROR:INTERNAL_NULL:798:808: [type=set] (set at line 798) Dereferencing NULL ptr "neigh" illegally! [val=1000]
> >
> > rt->key.saddr = src;
> > rt->rt_saddr = src;
> > rt->key.daddr = dst;
> > rt->rt_daddr = dst;
> > Start --->
> > rt->key.oif = neigh ? neigh->dev->ifindex : -1;
> > rt->key.iif = 0;
> > rt->key.fwmark = 0;
> >
> > rt->u.dst.neighbour = neigh;
> > rt->u.dst.dev = neigh ? neigh->dev : NULL;
> > rt->u.dst.lastuse = jiffies;
> > rt->u.dst.output = dn_output;
> > rt->u.dst.input = dn_rt_bug;
> >
> > Error --->
> > if (dn_dev_islocal(neigh->dev, rt->rt_daddr))
> > rt->u.dst.input = dn_nsp_rx;
> >
> > hash = dn_hash(rt->key.saddr, rt->key.daddr);
>
> Yeah, this one is wrong, I'll leave this to Steve Whitehouse though,
> the DecNET maintainer.
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu May 31 2001 - 21:00:42 EST