2008-05-05 19:38:58

by Luis Carlos Cobo

[permalink] [raw]
Subject: [PATCH] mac80211: fix access to null skb

Without this patch, if xmit_skb is null but net_ratelimit() returns 0 we would
go to the else branch and access the null xmit_skb. Pointed out by Johannes
Berg.

Signed-off-by: Luis Carlos Cobo <[email protected]>
---
net/mac80211/rx.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e8b89c8..bc66d99 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1300,11 +1300,11 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
if (is_multicast_ether_addr(skb->data)) {
if (*mesh_ttl > 0) {
xmit_skb = skb_copy(skb, GFP_ATOMIC);
- if (!xmit_skb && net_ratelimit())
+ if (xmit_skb)
+ xmit_skb->pkt_type = PACKET_OTHERHOST;
+ else if (net_ratelimit())
printk(KERN_DEBUG "%s: failed to clone "
"multicast frame\n", dev->name);
- else
- xmit_skb->pkt_type = PACKET_OTHERHOST;
} else
IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
dropped_frames_ttl);
--
1.5.4.3





2008-05-05 19:43:31

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fix access to null skb

On Mon, 2008-05-05 at 12:29 -0700, Luis Carlos Cobo wrote:
> Without this patch, if xmit_skb is null but net_ratelimit() returns 0 we would
> go to the else branch and access the null xmit_skb. Pointed out by Johannes
> Berg.

Thanks Luis, for both patches.

johannes


Attachments:
signature.asc (828.00 B)
This is a digitally signed message part