Re: [PATCH 8/8] xfrm: Fix potential null pointer dereference in xdst_queue_output

[Eric Dumazet <eric.dumazet@gmail.com>]

On Wed, 2013-08-28 at 13:04 +0200, Steffen Klassert wrote:
> The net_device might be not set on the skb when we try refcounting.
> This leads to a null pointer dereference in xdst_queue_output().
> It turned out that the refcount to the net_device is not needed
> after all. The dst_entry has a refcount to the net_device before
> we queue the skb, so it can't go away. Therefore we can remove the
> refcount on queueing to fix the null pointer dereference.
> 
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> ---
>  net/xfrm/xfrm_policy.c |    9 +--------
>  1 file changed, 1 insertion(+), 8 deletions(-)
> 
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index e52cab3..f77c371 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -320,10 +320,8 @@ static void xfrm_queue_purge(struct sk_buff_head *list)
>  {
>  	struct sk_buff *skb;
>  
> -	while ((skb = skb_dequeue(list)) != NULL) {
> -		dev_put(skb->dev);
> +	while ((skb = skb_dequeue(list)) != NULL)
>  		kfree_skb(skb);
> -	}
>  }
>  

xfrm_queue_purge() now looks a lot like skb_queue_purge() ;)