[lkml]   [2011]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[036/244] atm: br2684: Fix oops due to skb->dev being NULL
3.0-stable review patch.  If anyone has any objections, please let us know.

From: Daniel Schwierzeck <>

commit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream.

This oops have been already fixed with commit


atm: [br2684] Fix oops due to skb->dev being NULL

It happens that if a packet arrives in a VC between the call to open it on
the hardware and the call to change the backend to br2684, br2684_regvcc
processes the packet and oopses dereferencing skb->dev because it is
NULL before the call to br2684_push().

but have been introduced again with commit


atm: Use SKB queue and list helpers instead of doing it by-hand.

Signed-off-by: Daniel Schwierzeck <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>

net/atm/br2684.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -558,12 +558,13 @@ static int br2684_regvcc(struct atm_vcc
spin_unlock_irqrestore(&rq->lock, flags);

skb_queue_walk_safe(&queue, skb, tmp) {
- struct net_device *dev = skb->dev;
+ struct net_device *dev;
+ br2684_push(atmvcc, skb);
+ dev = skb->dev;

dev->stats.rx_bytes -= skb->len;
- br2684_push(atmvcc, skb);

/* initialize netdev carrier state */

 \ /
  Last update: 2011-09-29 01:07    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean