Re: [PATCH][AX25] ax25_out: check skb for NULL in ax25_kick()

["Jann Traschewski" <jann@gmx.de>]

Applied and stable with Kernel 2.6.24.2 since 12 hours.
Regards,
Jann

> -----Ursprüngliche Nachricht-----
> Von: Jarek Poplawski [mailto:jarkao2@gmail.com] 
> Gesendet: Mittwoch, 13. Februar 2008 12:56
> An: David Miller
> Cc: Jann Traschewski; Bernard Pidoux F6BVP; Ralf Baechle; 
> netdev@vger.kernel.org
> Betreff: [PATCH][AX25] ax25_out: check skb for NULL in ax25_kick()
> 
> Hi,
> 
> Here is an "official" version of "testing patch #2" from this thread.
> The only difference: ax25->vs is changed only after checking 
> skb is not NULL (plus a comment). IMHO it could be applied.
> 
> Thanks,
> Jarek P.
> 
> ---------------->
> 
> Subject: [AX25] ax25_out: check skb for NULL in ax25_kick()
> 
> According to some OOPS reports ax25_kick tries to clone NULL 
> skbs sometimes. It looks like a race with 
> ax25_clear_queues(). Probably there is no need to add more 
> than a simple check for this yet.
> Another report suggested there are probably also cases where ax25
> ->paclen == 0 can happen in ax25_output(); this wasn't confirmed
> during testing but let's leave this debugging check for some time.
> 
> 
> Reported-and-tested-by: Jann Traschewski <jann@gmx.de>
> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
> 
> ---
> 
> diff -Nurp 2.6.24-mm1-/net/ax25/ax25_out.c 
> 2.6.24-mm1+/net/ax25/ax25_out.c
> --- 2.6.24-mm1-/net/ax25/ax25_out.c	2008-01-24 
> 22:58:37.000000000 +0000
> +++ 2.6.24-mm1+/net/ax25/ax25_out.c	2008-02-13 
> 10:43:50.000000000 +0000
> @@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int pacl
>  	unsigned char *p;
>  	int frontlen, len, fragno, ka9qfrag, first = 1;
>  
> +	if (paclen < 16) {
> +		WARN_ON_ONCE(1);
> +		kfree_skb(skb);
> +		return;
> +	}
> +
>  	if ((skb->len - 1) > paclen) {
>  		if (*skb->data == AX25_P_TEXT) {
>  			skb_pull(skb, 1); /* skip PID */
> @@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
>  	if (start == end)
>  		return;
>  
> -	ax25->vs = start;
> -
>  	/*
>  	 * Transmit data until either we're out of data to send or
>  	 * the window is full. Send a poll on the final I frame 
> if @@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
>  
>  	/*
>  	 * Dequeue the frame and copy it.
> +	 * Check for race with ax25_clear_queues().
>  	 */
>  	skb  = skb_dequeue(&ax25->write_queue);
> +	if (!skb)
> +		return;
> +
> +	ax25->vs = start;
>  
>  	do {
>  		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {