| From 43091c408bb4c889fad1b772761268d8465397d4 Mon Sep 17 00:00:00 2001 |
| From: Daniel Schwierzeck <daniel.schwierzeck@googlemail.com> |
| Date: Fri, 19 Aug 2011 12:04:20 +0000 |
| Subject: [PATCH] atm: br2684: Fix oops due to skb->dev being NULL |
| |
| commit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream. |
| |
| This oops have been already fixed with commit |
| |
| 27141666b69f535a4d63d7bc6d9e84ee5032f82a |
| |
| atm: [br2684] Fix oops due to skb->dev being NULL |
| |
| It happens that if a packet arrives in a VC between the call to open it on |
| the hardware and the call to change the backend to br2684, br2684_regvcc |
| processes the packet and oopses dereferencing skb->dev because it is |
| NULL before the call to br2684_push(). |
| |
| but have been introduced again with commit |
| |
| b6211ae7f2e56837c6a4849316396d1535606e90 |
| |
| atm: Use SKB queue and list helpers instead of doing it by-hand. |
| |
| Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@googlemail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/atm/br2684.c b/net/atm/br2684.c |
| index f3bae14..e9b5677 100644 |
| --- a/net/atm/br2684.c |
| +++ b/net/atm/br2684.c |
| @@ -522,12 +522,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg) |
| spin_unlock_irqrestore(&rq->lock, flags); |
| |
| skb_queue_walk_safe(&queue, skb, tmp) { |
| - struct net_device *dev = skb->dev; |
| + struct net_device *dev; |
| + |
| + br2684_push(atmvcc, skb); |
| + dev = skb->dev; |
| |
| dev->stats.rx_bytes -= skb->len; |
| dev->stats.rx_packets--; |
| - |
| - br2684_push(atmvcc, skb); |
| } |
| __module_get(THIS_MODULE); |
| return 0; |
| -- |
| 1.7.12.rc1.1.gbce1580 |
| |
