diff options
author | Jorge Boncompte [DTI2] <jorge@dti2.net> | 2008-06-16 20:15:33 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-06-16 20:15:33 -0400 |
commit | 27141666b69f535a4d63d7bc6d9e84ee5032f82a (patch) | |
tree | b1aec050d32e5a2d1d75e8c88b4407c409720a33 /net/atm | |
parent | a9d246dbb07cf0bd32bbfc5d184ed738bf2af4f8 (diff) |
atm: [br2684] Fix oops due to skb->dev being NULL
It happens that if a packet arrives in a VC between the call to open it on
the hardware and the call to change the backend to br2684, br2684_regvcc
processes the packet and oopses dereferencing skb->dev because it is
NULL before the call to br2684_push().
Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Diffstat (limited to 'net/atm')
-rw-r--r-- | net/atm/br2684.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/atm/br2684.c b/net/atm/br2684.c index 9d52ebfc196..ac6035046ad 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c | |||
@@ -518,9 +518,9 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg) | |||
518 | struct sk_buff *next = skb->next; | 518 | struct sk_buff *next = skb->next; |
519 | 519 | ||
520 | skb->next = skb->prev = NULL; | 520 | skb->next = skb->prev = NULL; |
521 | br2684_push(atmvcc, skb); | ||
521 | BRPRIV(skb->dev)->stats.rx_bytes -= skb->len; | 522 | BRPRIV(skb->dev)->stats.rx_bytes -= skb->len; |
522 | BRPRIV(skb->dev)->stats.rx_packets--; | 523 | BRPRIV(skb->dev)->stats.rx_packets--; |
523 | br2684_push(atmvcc, skb); | ||
524 | 524 | ||
525 | skb = next; | 525 | skb = next; |
526 | } | 526 | } |