mac80211: Use queue_lock() in ieee80211_ht_agg_queue_remove().

[linux-2.6] / net / can / af_can.c

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7e8ca2836452a5053c4695691ceba78a9d4605d1..8035fbf526ae24e5fabff5b1c588abb8769e3c67 100644 (file)
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
  *  -ENOBUFS on full driver queue (see net_xmit_errno())
  *  -ENOMEM when local loopback failed at calling skb_clone()
  *  -EPERM when trying to send on a non-CAN interface
+ *  -EINVAL when the skb->data does not contain a valid CAN frame
  */
 int can_send(struct sk_buff *skb, int loop)
 {
        struct sk_buff *newskb = NULL;
+       struct can_frame *cf = (struct can_frame *)skb->data;
        int err;
 
+       if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
+               kfree_skb(skb);
+               return -EINVAL;
+       }
+
        if (skb->dev->type != ARPHRD_CAN) {
                kfree_skb(skb);
                return -EPERM;
@@ -605,13 +612,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type *pt, struct net_device *orig_dev)
 {
        struct dev_rcv_lists *d;
+       struct can_frame *cf = (struct can_frame *)skb->data;
        int matches;
 
-       if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {
+       if (dev->type != ARPHRD_CAN || !net_eq(dev_net(dev), &init_net)) {
                kfree_skb(skb);
                return 0;
        }
 
+       BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
+
        /* update statistics */
        can_stats.rx_frames++;
        can_stats.rx_frames_delta++;
@@ -718,7 +728,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
        struct net_device *dev = (struct net_device *)data;
        struct dev_rcv_lists *d;
 
-       if (dev_net(dev) != &init_net)
+       if (!net_eq(dev_net(dev), &init_net))
                return NOTIFY_DONE;
 
        if (dev->type != ARPHRD_CAN)