[AX25] ax25_out: check skb for NULL in ax25_kick()

According to some OOPS reports ax25_kick tries to clone NULL skbs
sometimes. It looks like a race with ax25_clear_queues(). Probably
there is no need to add more than a simple check for this yet.
Another report suggested there are probably also cases where ax25
->paclen == 0 can happen in ax25_output(); this wasn't confirmed
during testing but let's leave this debugging check for some time.

Reported-and-tested-by: Jann Traschewski <jann@gmx.de>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 92b517af7260f988561a88e25764b759ac48faa8..bf706f83a5c9b123d2a14f210a7fe19510030590 100644 (file)
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
        unsigned char *p;
        int frontlen, len, fragno, ka9qfrag, first = 1;
 
+       if (paclen < 16) {
+               WARN_ON_ONCE(1);
+               kfree_skb(skb);
+               return;
+       }
+
        if ((skb->len - 1) > paclen) {
                if (*skb->data == AX25_P_TEXT) {
                        skb_pull(skb, 1); /* skip PID */
@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
        if (start == end)
                return;
 
-       ax25->vs = start;
-
        /*
         * Transmit data until either we're out of data to send or
         * the window is full. Send a poll on the final I frame if
@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
 
        /*
         * Dequeue the frame and copy it.
+        * Check for race with ax25_clear_queues().
         */
        skb  = skb_dequeue(&ax25->write_queue);
+       if (!skb)
+               return;
+
+       ax25->vs = start;
 
        do {
                if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {