lkml.org 
[lkml]   [2008]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectAX25 ax25_out: check skb for NULL in ax25_kick()
    -stable review patch.  If anyone has any objections, please let us know.
    ---------------------

    From: Jarek Poplawski <jarkao2@gmail.com>

    Upstream commit: f47b7257c7368698eabff6fd7b340071932af640

    According to some OOPS reports ax25_kick tries to clone NULL skbs
    sometimes. It looks like a race with ax25_clear_queues(). Probably
    there is no need to add more than a simple check for this yet.
    Another report suggested there are probably also cases where ax25
    ->paclen == 0 can happen in ax25_output(); this wasn't confirmed
    during testing but let's leave this debugging check for some time.

    Reported-and-tested-by: Jann Traschewski <jann@gmx.de>
    Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    ---
    net/ax25/ax25_out.c | 13 +++++++++++--
    1 file changed, 11 insertions(+), 2 deletions(-)

    --- a/net/ax25/ax25_out.c
    +++ b/net/ax25/ax25_out.c
    @@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int pacl
    unsigned char *p;
    int frontlen, len, fragno, ka9qfrag, first = 1;

    + if (paclen < 16) {
    + WARN_ON_ONCE(1);
    + kfree_skb(skb);
    + return;
    + }
    +
    if ((skb->len - 1) > paclen) {
    if (*skb->data == AX25_P_TEXT) {
    skb_pull(skb, 1); /* skip PID */
    @@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
    if (start == end)
    return;

    - ax25->vs = start;
    -
    /*
    * Transmit data until either we're out of data to send or
    * the window is full. Send a poll on the final I frame if
    @@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)

    /*
    * Dequeue the frame and copy it.
    + * Check for race with ax25_clear_queues().
    */
    skb = skb_dequeue(&ax25->write_queue);
    + if (!skb)
    + return;
    +
    + ax25->vs = start;

    do {
    if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
    --


    \
     
     \ /
      Last update: 2008-04-17 03:21    [W:4.224 / U:0.588 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site