diff options
| author | Daniel Schwierzeck <daniel.schwierzeck@googlemail.com> | 2011-08-19 12:04:20 +0000 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2012-08-17 15:35:07 -0400 |
| commit | 0dc7814d12a5bdf6648edd635d5f52f50f0ca04b (patch) | |
| tree | 3bf29ec6ef21c406e546cd702d9f9b5ee6852861 /net | |
| parent | 695ef896f612667d70df4f837e2f110e079eaa68 (diff) | |
atm: br2684: Fix oops due to skb->dev being NULL
commit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream.
This oops have been already fixed with commit
27141666b69f535a4d63d7bc6d9e84ee5032f82a
atm: [br2684] Fix oops due to skb->dev being NULL
It happens that if a packet arrives in a VC between the call to open it on
the hardware and the call to change the backend to br2684, br2684_regvcc
processes the packet and oopses dereferencing skb->dev because it is
NULL before the call to br2684_push().
but have been introduced again with commit
b6211ae7f2e56837c6a4849316396d1535606e90
atm: Use SKB queue and list helpers instead of doing it by-hand.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/atm/br2684.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/atm/br2684.c b/net/atm/br2684.c index f3bae1476798..e9b567731fc4 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c @@ -522,12 +522,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg) spin_unlock_irqrestore(&rq->lock, flags); skb_queue_walk_safe(&queue, skb, tmp) { - struct net_device *dev = skb->dev; + struct net_device *dev; + + br2684_push(atmvcc, skb); + dev = skb->dev; dev->stats.rx_bytes -= skb->len; dev->stats.rx_packets--; - - br2684_push(atmvcc, skb); } __module_get(THIS_MODULE); return 0; |