net: ipv6: raw: fixes null pointer deference in rawv6_push_pending_frames

[Kyle Zeng <zengyhkyle@gmail.com>]

The local variable csum_skb is initialized to NULL. It is posible that the skb_queue_walkloop
does not assign csum_skb to a real skb. After the loop, skb will be set to csum_skb, which
means skb is set to NULL. Then when the skb is used later, null pointer deference bug happens.
This patch catches the case and avoids the oops.

Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
---
 net/ipv6/raw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index a06a9f847..982a8b77a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -556,6 +556,9 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 		skb = csum_skb;
 	}
 
+	if (skb == NULL)
+		goto out;
+
 	offset += skb_transport_offset(skb);
 	err = skb_copy_bits(skb, offset, &csum, 2);
 	if (err < 0) {
-- 
2.34.1