usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer

[pandora-kernel.git] / net / netfilter / nf_queue.c

diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 99ffd28..6d70533 100644 (file)
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -40,7 +40,7 @@ int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
        else if (old)
                ret = -EBUSY;
        else {
-               RCU_INIT_POINTER(queue_handler[pf], qh);
+               rcu_assign_pointer(queue_handler[pf], qh);
                ret = 0;
        }
        mutex_unlock(&queue_handler_mutex);
@@ -233,7 +233,7 @@ int nf_queue(struct sk_buff *skb,
         * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean
         * 'ignore this hook'.
         */
-       if (IS_ERR(segs))
+       if (IS_ERR_OR_NULL(segs))
                return -EINVAL;
 
        queued = 0;