git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
[pandora-kernel.git]
/
drivers
/
connector
/
connector.c
diff --git
a/drivers/connector/connector.c
b/drivers/connector/connector.c
index
dde6a0f
..
8982912
100644
(file)
--- a/
drivers/connector/connector.c
+++ b/
drivers/connector/connector.c
@@
-154,25
+154,21
@@
static int cn_call_callback(struct sk_buff *skb)
*
* It checks skb, netlink header and msg sizes, and calls callback helper.
*/
*
* It checks skb, netlink header and msg sizes, and calls callback helper.
*/
-static void cn_rx_skb(struct sk_buff *
__
skb)
+static void cn_rx_skb(struct sk_buff *skb)
{
struct nlmsghdr *nlh;
{
struct nlmsghdr *nlh;
- int err;
- struct sk_buff *skb;
-
- skb = skb_get(__skb);
+ int len, err;
if (skb->len >= NLMSG_SPACE(0)) {
nlh = nlmsg_hdr(skb);
if (skb->len >= NLMSG_SPACE(0)) {
nlh = nlmsg_hdr(skb);
+ len = nlmsg_len(nlh);
- if (
nlh->nlmsg_len <
sizeof(struct cn_msg) ||
+ if (
len < (int)
sizeof(struct cn_msg) ||
skb->len < nlh->nlmsg_len ||
skb->len < nlh->nlmsg_len ||
- nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
- kfree_skb(skb);
+ len > CONNECTOR_MAX_MSG_SIZE)
return;
return;
- }
- err = cn_call_callback(skb);
+ err = cn_call_callback(skb
_get(skb)
);
if (err < 0)
kfree_skb(skb);
}
if (err < 0)
kfree_skb(skb);
}