Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f47b7257 authored by Jarek Poplawski's avatar Jarek Poplawski Committed by David S. Miller
Browse files

[AX25] ax25_out: check skb for NULL in ax25_kick() 



According to some OOPS reports ax25_kick tries to clone NULL skbs
sometimes. It looks like a race with ax25_clear_queues(). Probably
there is no need to add more than a simple check for this yet.
Another report suggested there are probably also cases where ax25
->paclen == 0 can happen in ax25_output(); this wasn't confirmed
during testing but let's leave this debugging check for some time.

Reported-and-tested-by: default avatarJann Traschewski <jann@gmx.de>
Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9bf1d83e

net/ax25/ax25_out.c

+11 −2
Original line number Original line Diff line number Diff line
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb) 
	unsigned char *p;

	unsigned char *p;

	int frontlen, len, fragno, ka9qfrag, first = 1;

	int frontlen, len, fragno, ka9qfrag, first = 1;





	if (paclen < 16) {

		WARN_ON_ONCE(1);

		kfree_skb(skb);

		return;

	}



	if ((skb->len - 1) > paclen) {

	if ((skb->len - 1) > paclen) {

		if (*skb->data == AX25_P_TEXT) {

		if (*skb->data == AX25_P_TEXT) {

			skb_pull(skb, 1); /* skip PID */

			skb_pull(skb, 1); /* skip PID */
@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25) 
	if (start == end)

	if (start == end)

		return;

		return;





	ax25->vs = start;



	/*

	/*

	 * Transmit data until either we're out of data to send or

	 * Transmit data until either we're out of data to send or

	 * the window is full. Send a poll on the final I frame if

	 * the window is full. Send a poll on the final I frame if
@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25) 




	/*

	/*

	 * Dequeue the frame and copy it.

	 * Dequeue the frame and copy it.

	 * Check for race with ax25_clear_queues().

	 */

	 */

	skb  = skb_dequeue(&ax25->write_queue);

	skb  = skb_dequeue(&ax25->write_queue);

	if (!skb)

		return;



	ax25->vs = start;





	do {

	do {

		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {

		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {