summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJorge Boncompte [DTI2] <jorge@dti2.net>2008-06-16 17:15:33 -0700
committerDavid S. Miller <davem@davemloft.net>2008-06-16 17:15:33 -0700
commit27141666b69f535a4d63d7bc6d9e84ee5032f82a (patch)
treeb1aec050d32e5a2d1d75e8c88b4407c409720a33
parenta9d246dbb07cf0bd32bbfc5d184ed738bf2af4f8 (diff)
atm: [br2684] Fix oops due to skb->dev being NULL
It happens that if a packet arrives in a VC between the call to open it on the hardware and the call to change the backend to br2684, br2684_regvcc processes the packet and oopses dereferencing skb->dev because it is NULL before the call to br2684_push(). Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net> Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
-rw-r--r--net/atm/br2684.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 9d52ebfc1962..ac6035046adc 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -518,9 +518,9 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
struct sk_buff *next = skb->next;
skb->next = skb->prev = NULL;
+ br2684_push(atmvcc, skb);
BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
BRPRIV(skb->dev)->stats.rx_packets--;
- br2684_push(atmvcc, skb);
skb = next;
}