From bd2dd2e45815f8c5c79229e7791043ba54e2dbc8 Mon Sep 17 00:00:00 2001
From: Jarek Poplawski <jarkao2@gmail.com>
Date: Sun, 17 Feb 2008 22:31:19 -0800
Subject: [PATCH] --- yaml --- r: 85835 b: refs/heads/master c:
 f47b7257c7368698eabff6fd7b340071932af640 h: refs/heads/master i:   85833:
 a59bc49220ca217668187590aa0fa458a0f2a088   85831:
 3fd30ad074d7ec17f66d3e6c8509518d8d8e21fe v: v3

---
 [refs]                    |  2 +-
 trunk/net/ax25/ax25_out.c | 13 +++++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 104f2c3850e7..cde581747072 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9bf1d83e7ee653862ef740435a7f41e8fd6452a9
+refs/heads/master: f47b7257c7368698eabff6fd7b340071932af640
diff --git a/trunk/net/ax25/ax25_out.c b/trunk/net/ax25/ax25_out.c
index 92b517af7260..bf706f83a5c9 100644
--- a/trunk/net/ax25/ax25_out.c
+++ b/trunk/net/ax25/ax25_out.c
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
 	unsigned char *p;
 	int frontlen, len, fragno, ka9qfrag, first = 1;
 
+	if (paclen < 16) {
+		WARN_ON_ONCE(1);
+		kfree_skb(skb);
+		return;
+	}
+
 	if ((skb->len - 1) > paclen) {
 		if (*skb->data == AX25_P_TEXT) {
 			skb_pull(skb, 1); /* skip PID */
@@ -251,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
 	if (start == end)
 		return;
 
-	ax25->vs = start;
-
 	/*
 	 * Transmit data until either we're out of data to send or
 	 * the window is full. Send a poll on the final I frame if
@@ -261,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
 
 	/*
 	 * Dequeue the frame and copy it.
+	 * Check for race with ax25_clear_queues().
 	 */
 	skb  = skb_dequeue(&ax25->write_queue);
+	if (!skb)
+		return;
+
+	ax25->vs = start;
 
 	do {
 		if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {