aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
authorYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>2007-09-11 05:31:43 -0400
committerDavid S. Miller <davem@davemloft.net>2007-09-11 05:31:43 -0400
commite1f52208bb968291f7d9142eff60b62984b4a511 (patch)
tree562076978b4a8f71f4cf49903496cf95ab02d3d2 /net/ipv6
parent16fcec35e7d7c4faaa4709f6434a4a25b06d25e3 (diff)
[IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames
Some of skbs in sk->write_queue do not have skb->dst because we do not fill skb->dst when we allocate new skb in append_data(). BTW, I think we may not need to (or we should not) increment some stats when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets, how many should we increment? If 100, we should set skb->dst for every queued skbs. If 1 (or 2 (*)), we increment the stats for the first queued skb and we should just skip incrementing OutDiscards for the rest of queued skbs, adn we should also impelement this semantics in other places; e.g., we should increment other stats just once, not 100 times. *: depends on the place we are discarding the datagram. I guess should just increment by 1 (or 2). Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/ip6_output.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5dead399fe64..26de3c0ea31e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1427,8 +1427,9 @@ void ip6_flush_pending_frames(struct sock *sk)
1427 struct sk_buff *skb; 1427 struct sk_buff *skb;
1428 1428
1429 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) { 1429 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1430 IP6_INC_STATS(ip6_dst_idev(skb->dst), 1430 if (skb->dst)
1431 IPSTATS_MIB_OUTDISCARDS); 1431 IP6_INC_STATS(ip6_dst_idev(skb->dst),
1432 IPSTATS_MIB_OUTDISCARDS);
1432 kfree_skb(skb); 1433 kfree_skb(skb);
1433 } 1434 }
1434 1435