diff options
| author | Ingo Molnar <mingo@elte.hu> | 2008-11-20 09:03:38 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-11-20 09:03:38 +0100 |
| commit | 90accd6fabf9b2fa2705945a4c601877a75d43bf (patch) | |
| tree | d393cb54f0228b1313139e4e14adf4f5cf236b59 /net/phonet/af_phonet.c | |
| parent | b43d196c4d3fe46d6dda7c987c47792612b80b1b (diff) | |
| parent | ee2f6cc7f9ea2542ad46070ed62ba7aa04d08871 (diff) | |
Merge branch 'linus' into x86/memory-corruption-check
Diffstat (limited to 'net/phonet/af_phonet.c')
| -rw-r--r-- | net/phonet/af_phonet.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index b9d97effebe..7ab30f668b5 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -144,8 +144,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev, struct phonethdr *ph; int err; - if (skb->len + 2 > 0xffff) { - /* Phonet length field would overflow */ + if (skb->len + 2 > 0xffff /* Phonet length field limit */ || + skb->len + sizeof(struct phonethdr) > dev->mtu) { err = -EMSGSIZE; goto drop; } @@ -261,6 +261,8 @@ static inline int can_respond(struct sk_buff *skb) return 0; /* we are not the destination */ if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5)) return 0; + if (ph->pn_res == PN_COMMGR) /* indications */ + return 0; ph = pn_hdr(skb); /* re-acquires the pointer */ pm = pn_msg(skb); @@ -309,7 +311,8 @@ static int send_reset_indications(struct sk_buff *rskb) return pn_raw_send(data, sizeof(data), rskb->dev, pn_object(oph->pn_sdev, 0x00), - pn_object(oph->pn_rdev, oph->pn_robj), 0x10); + pn_object(oph->pn_rdev, oph->pn_robj), + PN_COMMGR); } |