[IRDA]: Fix rfcomm use-after-free

[pandora-kernel.git] / net / ipv4 / tcp_minisocks.c

diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index ac4ce48..a12b08f 100644 (file)
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -246,7 +246,7 @@ kill:
        if (paws_reject)
                NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 
-       if(!th->rst) {
+       if (!th->rst) {
                /* In this case we must reset the TIMEWAIT timer.
                 *
                 * If it is ACKless SYN it may be both old duplicate
@@ -324,7 +324,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                                if (tcp_alloc_md5sig_pool() == NULL)
                                        BUG();
                        }
-               } while(0);
+               } while (0);
 #endif
 
                /* Linkage updates. */
@@ -438,7 +438,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                                                       keepalive_time_when(newtp));
 
                newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
-               if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
+               if ((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
                        if (sysctl_tcp_fack)
                                newtp->rx_opt.sack_ok |= 2;
                }
@@ -453,7 +453,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                        newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
                        newtp->window_clamp = min(newtp->window_clamp, 65535U);
                }
-               newtp->snd_wnd = ntohs(skb->h.th->window) << newtp->rx_opt.snd_wscale;
+               newtp->snd_wnd = (ntohs(tcp_hdr(skb)->window) <<
+                                 newtp->rx_opt.snd_wscale);
                newtp->max_window = newtp->snd_wnd;
 
                if (newtp->rx_opt.tstamp_ok) {
@@ -488,7 +489,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                           struct request_sock *req,
                           struct request_sock **prev)
 {
-       struct tcphdr *th = skb->h.th;
+       const struct tcphdr *th = tcp_hdr(skb);
        __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
        int paws_reject = 0;
        struct tcp_options_received tmp_opt;
@@ -710,8 +711,8 @@ int tcp_child_process(struct sock *parent, struct sock *child,
        int state = child->sk_state;
 
        if (!sock_owned_by_user(child)) {
-               ret = tcp_rcv_state_process(child, skb, skb->h.th, skb->len);
-
+               ret = tcp_rcv_state_process(child, skb, tcp_hdr(skb),
+                                           skb->len);
                /* Wakeup parent, send SIGIO */
                if (state == TCP_SYN_RECV && child->sk_state != state)
                        parent->sk_data_ready(parent, 0);