[AX25] ax25_out: check skb for NULL in ax25_kick() (f47b7257) · Commits · 戴 / test

According to some OOPS reports ax25_kick tries to clone NULL skbs sometimes. It looks like a race with ax25_clear_queues(). Probably there is no need to add more than a simple check for this yet. Another report suggested there are probably also cases where ax25 ->paclen == 0 can happen in ax25_output(); this wasn't confirmed during testing but let's leave this debugging check for some time. Reported-and-tested-by:

Jann Traschewski <jann@gmx.de> Signed-off-by:

Jarek Poplawski <jarkao2@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ax25/ax25_out.c

+11 −2

Original line number	Diff line number	Diff line
		@@ -117,6 +117,12 @@ void ax25_output(ax25_cb ax25, int paclen, struct sk_buff skb)
		unsigned char *p;
		int frontlen, len, fragno, ka9qfrag, first = 1;

		if (paclen < 16) {
		WARN_ON_ONCE(1);
		kfree_skb(skb);
		return;
		}

		if ((skb->len - 1) > paclen) {
		if (*skb->data == AX25_P_TEXT) {
		skb_pull(skb, 1); /* skip PID */
		@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
		if (start == end)
		return;

		ax25->vs = start;

		/*
		* Transmit data until either we're out of data to send or
		* the window is full. Send a poll on the final I frame if
		@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)

		/*
		* Dequeue the frame and copy it.
		* Check for race with ax25_clear_queues().
		*/
		skb = skb_dequeue(&ax25->write_queue);
		if (!skb)
		return;

		ax25->vs = start;

		do {
		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {

Admin message