mac80211: fix modprobe deadlock by not calling wep_init under rtnl_lock

[safe/jmp/linux-2.6] / net / ax25 / ax25_out.c

diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index 6e08dc8..bf706f8 100644 (file)
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -117,6 +117,12 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
        unsigned char *p;
        int frontlen, len, fragno, ka9qfrag, first = 1;
 
+       if (paclen < 16) {
+               WARN_ON_ONCE(1);
+               kfree_skb(skb);
+               return;
+       }
+
        if ((skb->len - 1) > paclen) {
                if (*skb->data == AX25_P_TEXT) {
                        skb_pull(skb, 1); /* skip PID */
@@ -148,8 +154,9 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
 
                        if (ka9qfrag == 1) {
                                skb_reserve(skbn, frontlen + 2);
-                               skbn->nh.raw = skbn->data + (skb->nh.raw - skb->data);
-                               memcpy(skb_put(skbn, len), skb->data, len);
+                               skb_set_network_header(skbn,
+                                                     skb_network_offset(skb));
+                               skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                                p = skb_push(skbn, 2);
 
                                *p++ = AX25_P_SEGMENT;
@@ -161,8 +168,9 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
                                }
                        } else {
                                skb_reserve(skbn, frontlen + 1);
-                               skbn->nh.raw = skbn->data + (skb->nh.raw - skb->data);
-                               memcpy(skb_put(skbn, len), skb->data, len);
+                               skb_set_network_header(skbn,
+                                                     skb_network_offset(skb));
+                               skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                                p = skb_push(skbn, 1);
                                *p = AX25_P_TEXT;
                        }
@@ -249,8 +257,6 @@ void ax25_kick(ax25_cb *ax25)
        if (start == end)
                return;
 
-       ax25->vs = start;
-
        /*
         * Transmit data until either we're out of data to send or
         * the window is full. Send a poll on the final I frame if
@@ -259,8 +265,13 @@ void ax25_kick(ax25_cb *ax25)
 
        /*
         * Dequeue the frame and copy it.
+        * Check for race with ax25_clear_queues().
         */
        skb  = skb_dequeue(&ax25->write_queue);
+       if (!skb)
+               return;
+
+       ax25->vs = start;
 
        do {
                if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {