Commit:     e1f52208bb968291f7d9142eff60b62984b4a511
Parent:     16fcec35e7d7c4faaa4709f6434a4a25b06d25e3
AuthorDate: Tue Sep 11 11:31:43 2007 +0200
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Sep 11 11:31:43 2007 +0200

    [IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames
    Some of skbs in sk->write_queue do not have skb->dst because
    we do not fill skb->dst when we allocate new skb in append_data().
    BTW, I think we may not need to (or we should not) increment some stats
    when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets,
    how many should we increment?
    If 100, we should set skb->dst for every queued skbs.
    If 1 (or 2 (*)), we increment the stats for the first queued skb and
    we should just skip incrementing OutDiscards for the rest of queued skbs,
    adn we should also impelement this semantics in other places;
    e.g., we should increment other stats just once, not 100 times.
    *: depends on the place we are discarding the datagram.
    I guess should just increment by 1 (or 2).
    Signed-off-by: YOSHIFUJI Hideaki <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv6/ip6_output.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5dead39..26de3c0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1427,8 +1427,9 @@ void ip6_flush_pending_frames(struct sock *sk)
        struct sk_buff *skb;
        while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
-               IP6_INC_STATS(ip6_dst_idev(skb->dst),
-                             IPSTATS_MIB_OUTDISCARDS);
+               if (skb->dst)
+                       IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                                     IPSTATS_MIB_OUTDISCARDS);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to