diff options
| author | Jarek Poplawski <jarkao2@gmail.com> | 2008-04-06 23:35:31 -0700 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2008-04-18 18:53:24 -0700 |
| commit | 0003f278998a59e72784048d7484e4a998ceab3d (patch) | |
| tree | f5da86022f20f739ce69dcfed4c9c3dfd9ddd26e /net/ax25 | |
| parent | b245c3b43439c715e33b57ca9b663123812dd208 (diff) | |
AX25 ax25_out: check skb for NULL in ax25_kick()
Upstream commit: f47b7257c7368698eabff6fd7b340071932af640
According to some OOPS reports ax25_kick tries to clone NULL skbs
sometimes. It looks like a race with ax25_clear_queues(). Probably
there is no need to add more than a simple check for this yet.
Another report suggested there are probably also cases where ax25
->paclen == 0 can happen in ax25_output(); this wasn't confirmed
during testing but let's leave this debugging check for some time.
Reported-and-tested-by: Jann Traschewski <jann@gmx.de>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'net/ax25')
| -rw-r--r-- | net/ax25/ax25_out.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c index 92b517af7260..bf706f83a5c9 100644 --- a/net/ax25/ax25_out.c +++ b/net/ax25/ax25_out.c @@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb) unsigned char *p; int frontlen, len, fragno, ka9qfrag, first = 1; + if (paclen < 16) { + WARN_ON_ONCE(1); + kfree_skb(skb); + return; + } + if ((skb->len - 1) > paclen) { if (*skb->data == AX25_P_TEXT) { skb_pull(skb, 1); /* skip PID */ @@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25) if (start == end) return; - ax25->vs = start; - /* * Transmit data until either we're out of data to send or * the window is full. Send a poll on the final I frame if @@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25) /* * Dequeue the frame and copy it. + * Check for race with ax25_clear_queues(). */ skb = skb_dequeue(&ax25->write_queue); + if (!skb) + return; + + ax25->vs = start; do { if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) { |