mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel

[safe/jmp/linux-2.6] / net / decnet / dn_nsp_out.c

diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 2d2cda8..2013c25 100644 (file)
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -79,7 +79,7 @@ static void dn_nsp_send(struct sk_buff *skb)
        struct dst_entry *dst;
        struct flowi fl;
 
-       skb->h.raw = skb->data;
+       skb_reset_transport_header(skb);
        scp->stamp = jiffies;
 
        dst = sk_dst_check(sk, 0);
@@ -124,7 +124,7 @@ struct sk_buff *dn_alloc_skb(struct sock *sk, int size, gfp_t pri)
        if ((skb = alloc_skb(size + hdr, pri)) == NULL)
                return NULL;
 
-       skb->protocol = __constant_htons(ETH_P_DNA_RT);
+       skb->protocol = htons(ETH_P_DNA_RT);
        skb->pkt_type = PACKET_OUTGOING;
 
        if (sk)
@@ -230,7 +230,6 @@ static inline unsigned dn_nsp_clone_and_send(struct sk_buff *skb,
 /**
  * dn_nsp_output - Try and send something from socket queues
  * @sk: The socket whose queues are to be investigated
- * @gfp: The memory allocation flags
  *
  * Try and send the packet on the end of the data and other data queues.
  * Other data gets priority over data, and if we retransmit a packet we
@@ -326,8 +325,8 @@ static __le16 *dn_mk_ack_header(struct sock *sk, struct sk_buff *skb, unsigned c
 
        ptr = (__le16 *)dn_mk_common_header(scp, skb, msgflag, hlen);
 
-       *ptr++ = dn_htons(acknum);
-       *ptr++ = dn_htons(ackcrs);
+       *ptr++ = cpu_to_le16(acknum);
+       *ptr++ = cpu_to_le16(ackcrs);
 
        return ptr;
 }
@@ -345,7 +344,7 @@ static __le16 *dn_nsp_mk_data_header(struct sock *sk, struct sk_buff *skb, int o
                cb->segnum = scp->numdat;
                seq_add(&scp->numdat, 1);
        }
-       *(ptr++) = dn_htons(cb->segnum);
+       *(ptr++) = cpu_to_le16(cb->segnum);
 
        return ptr;
 }
@@ -523,7 +522,7 @@ void dn_send_conn_conf(struct sock *sk, gfp_t gfp)
        struct dn_scp *scp = DN_SK(sk);
        struct sk_buff *skb = NULL;
        struct nsp_conn_init_msg *msg;
-       __u8 len = (__u8)dn_ntohs(scp->conndata_out.opt_optl);
+       __u8 len = (__u8)le16_to_cpu(scp->conndata_out.opt_optl);
 
        if ((skb = dn_alloc_skb(sk, 50 + len, gfp)) == NULL)
                return;
@@ -534,7 +533,7 @@ void dn_send_conn_conf(struct sock *sk, gfp_t gfp)
        msg->srcaddr = scp->addrloc;
        msg->services = scp->services_loc;
        msg->info = scp->info_loc;
-       msg->segsize = dn_htons(scp->segsize_loc);
+       msg->segsize = cpu_to_le16(scp->segsize_loc);
 
        *skb_put(skb,1) = len;
 
@@ -560,7 +559,7 @@ static __inline__ void dn_nsp_do_disc(struct sock *sk, unsigned char msgflg,
 
        if ((dst == NULL) || (rem == 0)) {
                if (net_ratelimit())
-                       printk(KERN_DEBUG "DECnet: dn_nsp_do_disc: BUG! Please report this to SteveW@ACM.org rem=%u dst=%p\n", dn_ntohs(rem), dst);
+                       printk(KERN_DEBUG "DECnet: dn_nsp_do_disc: BUG! Please report this to SteveW@ACM.org rem=%u dst=%p\n", le16_to_cpu(rem), dst);
                return;
        }
 
@@ -573,7 +572,7 @@ static __inline__ void dn_nsp_do_disc(struct sock *sk, unsigned char msgflg,
        msg += 2;
        *(__le16 *)msg = loc;
        msg += 2;
-       *(__le16 *)msg = dn_htons(reason);
+       *(__le16 *)msg = cpu_to_le16(reason);
        msg += 2;
        if (msgflg == NSP_DISCINIT)
                *msg++ = ddl;
@@ -599,10 +598,10 @@ void dn_nsp_send_disc(struct sock *sk, unsigned char msgflg,
        int ddl = 0;
 
        if (msgflg == NSP_DISCINIT)
-               ddl = dn_ntohs(scp->discdata_out.opt_optl);
+               ddl = le16_to_cpu(scp->discdata_out.opt_optl);
 
        if (reason == 0)
-               reason = dn_ntohs(scp->discdata_out.opt_status);
+               reason = le16_to_cpu(scp->discdata_out.opt_status);
 
        dn_nsp_do_disc(sk, msgflg, reason, gfp, sk->sk_dst_cache, ddl,
                scp->discdata_out.opt_data, scp->addrrem, scp->addrloc);
@@ -676,13 +675,15 @@ void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
        msg->srcaddr    = scp->addrloc;
        msg->services   = scp->services_loc;    /* Requested flow control    */
        msg->info       = scp->info_loc;        /* Version Number            */
-       msg->segsize    = dn_htons(scp->segsize_loc);   /* Max segment size  */
+       msg->segsize    = cpu_to_le16(scp->segsize_loc);        /* Max segment size  */
 
        if (scp->peer.sdn_objnum)
                type = 0;
 
-       skb_put(skb, dn_sockaddr2username(&scp->peer, skb->tail, type));
-       skb_put(skb, dn_sockaddr2username(&scp->addr, skb->tail, 2));
+       skb_put(skb, dn_sockaddr2username(&scp->peer,
+                                         skb_tail_pointer(skb), type));
+       skb_put(skb, dn_sockaddr2username(&scp->addr,
+                                         skb_tail_pointer(skb), 2));
 
        menuver = DN_MENUVER_ACC | DN_MENUVER_USR;
        if (scp->peer.sdn_flags & SDF_PROXY)
@@ -707,7 +708,7 @@ void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
        if (aux > 0)
        memcpy(skb_put(skb, aux), scp->accessdata.acc_acc, aux);
 
-       aux = (__u8)dn_ntohs(scp->conndata_out.opt_optl);
+       aux = (__u8)le16_to_cpu(scp->conndata_out.opt_optl);
        *skb_put(skb, 1) = aux;
        if (aux > 0)
        memcpy(skb_put(skb,aux), scp->conndata_out.opt_data, aux);