Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (60 commits)
  [NIU]: Bump driver version and release date.
  [NIU]: Fix BMAC alternate MAC address indexing.
  net: fix kernel-doc warnings in header files
  [IPV6]: Use BUG_ON instead of if + BUG in fib6_del_route.
  [IPV6]: dst_entry leak in ip4ip6_err. (resend)
  bluetooth: do not move child device other than rfcomm
  bluetooth: put hci dev after del conn
  [NET]: Elminate spurious print_mac() calls.
  [BLUETOOTH] hci_sysfs.c: Kill build warning.
  [NET]: Remove MAC_FMT
  net/8021q/vlan_dev.c: Use print_mac.
  [XFRM]: Fix ordering issue in xfrm_dst_hash_transfer().
  [BLUETOOTH] net/bluetooth/hci_core.c: Use time_* macros
  [IPV6]: Fix hardcoded removing of old module code
  [NETLABEL]: Move some initialization code into __init section.
  [NETLABEL]: Shrink the genl-ops registration code.
  [AX25] ax25_out: check skb for NULL in ax25_kick()
  [TCP]: Fix tcp_v4_send_synack() comment
  [IPV4]: fix alignment of IP-Config output
  Documentation: fix tcp.txt
  ...

1 files changed, 11 insertions, 2 deletions

diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 92b517af7260..bf706f83a5c9 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
         unsigned char *p;
         int frontlen, len, fragno, ka9qfrag, first = 1;
 
+        if (paclen < 16) {
+                WARN_ON_ONCE(1);
+                kfree_skb(skb);
+                return;
+        }
+
         if ((skb->len - 1) > paclen) {
                 if (*skb->data == AX25_P_TEXT) {
                         skb_pull(skb, 1); /* skip PID */
@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
         if (start == end)
                 return;
 
-        ax25->vs = start;
-
         /*
          * Transmit data until either we're out of data to send or
          * the window is full. Send a poll on the final I frame if
@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
 
         /*
          * Dequeue the frame and copy it.
+         * Check for race with ax25_clear_queues().
          */
         skb  = skb_dequeue(&ax25->write_queue);
+        if (!skb)
+                return;
+
+        ax25->vs = start;
 
         do {
                 if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {