Kernel oops with highly loaded links

["NMM van der Vlugt" <vanderVlugt@fel.tno.nl>]

Hi all,

When I use a cbq on a link with low bandwidth (a serial PPP link), I
will get the following oops. 

Unable to handle kernel NULL pointer dreference at virtual address
000000a4
current->tss.cr3 = 00101000, %cr3 = 00101000
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<c015fdec>]
EFLAGS: 00010207
eax: 000000404  ebx: c0098ed0   ecx: c13503f4   edx: c0fea468
esi: 000000000  edi: c0098ed0   ebp: c07c4290   esp: c0233ee4

I found that the problems are in the file net/sched/sch_cbq.c. One
problem is in the function cbq_dequeue_prio. In this function it's
possible that borrow will be NULL. The line borrow->xstats.borrow++;
will result in a kernel oops.

Another problem is in the last line of the function cbq_update. It
contains the following line:

cbq_update_toplevel(q, ths, q->tx_borrowed);

It is possble that this function is called with q->tx_borrowed = NULL.
This will result also in a kernel oops.

To keep things working I have placed a check for NULL before these two
lines, but that is not the right solution. Does anyone have a better
idea.

Marco