Date: Fri, 30 Nov 2001 20:57:18 +0100 From: Maxime Henrion <mux@qualys.com> To: cvs-all@FreeBSD.org Cc: Ruslan Ermilov <ru@FreeBSD.org> Subject: Re: cvs commit: src/sys/netinet icmp_var.h ip_icmp.c ip_input.c ip_var.h src/usr.bin/netstat inet.c Message-ID: <20011130205718.A275@nebula.noos.fr> In-Reply-To: <200111301040.fAUAeS519148@freefall.freebsd.org> References: <200111301040.fAUAeS519148@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--mP3DRpeJDSE+ciuQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Ruslan Ermilov wrote:
> ru 2001/11/30 02:40:28 PST
>
> Modified files:
> sys/netinet icmp_var.h ip_icmp.c ip_input.c ip_var.h
> usr.bin/netstat inet.c
[...]
This commit appears to break the kernel. In some cases, icmp_reflect()
calls icmp_send() with a NULL pointer for the struct route * parameter.
icmp_send() then pass it to ip_output() which dereferences it.
I've had several panics like this at boot, and also got some lockups for
reasons I ignore. :-)
It seems to me that in the icmp_reflect() code it is intentional to call
icmp_send() with a NULL pointer, so I did a little patch that use a
struct route bzero'ed in that case in icmp_send() as it was in revision
1.63. It probably isn't a correct patch but at least it solved the
problem.
Thanks,
Maxime Henrion
--
Don't be fooled by cheap finnish imitations ; BSD is the One True Code
--mP3DRpeJDSE+ciuQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="ip_icmp.diff"
Index: ip_icmp.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_icmp.c,v
retrieving revision 1.64
diff -u -r1.64 ip_icmp.c
--- ip_icmp.c 30 Nov 2001 10:40:27 -0000 1.64
+++ ip_icmp.c 30 Nov 2001 19:48:41 -0000
@@ -728,6 +728,7 @@
register struct ip *ip = mtod(m, struct ip *);
register int hlen;
register struct icmp *icp;
+ struct route ro;
hlen = IP_VHL_HL(ip->ip_vhl) << 2;
m->m_data += hlen;
@@ -746,6 +747,10 @@
buf, inet_ntoa(ip->ip_src));
}
#endif
+ if (rt == NULL) {
+ bzero(&ro, sizeof (ro));
+ rt = &ro;
+ }
(void) ip_output(m, opts, rt, 0, NULL);
}
--mP3DRpeJDSE+ciuQ--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011130205718.A275>