From: Jorge Boncompte [DTI2] <jorge@dti2.net>
Date: Tue, 17 Jun 2008 00:15:33 +0000 (-0700)
Subject: atm: [br2684] Fix oops due to skb->dev being NULL
X-Git-Tag: v2.6.26-rc7~20^2~15
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=27141666b69f535a4d63d7bc6d9e84ee5032f82a;p=linux-2.6

atm: [br2684] Fix oops due to skb->dev being NULL

It happens that if a packet arrives in a VC between the call to open it on
the hardware and the call to change the backend to br2684, br2684_regvcc
processes the packet and oopses dereferencing skb->dev because it is
NULL before the call to br2684_push().

Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
---

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 9d52ebfc19..ac6035046a 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -518,9 +518,9 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
 		struct sk_buff *next = skb->next;
 
 		skb->next = skb->prev = NULL;
+		br2684_push(atmvcc, skb);
 		BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
 		BRPRIV(skb->dev)->stats.rx_packets--;
-		br2684_push(atmvcc, skb);
 
 		skb = next;
 	}