loop: fix NULL dereference if mount fails

[safe/jmp/linux-2.6] / net / econet / af_econet.c

diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 9cae16b..0e0254f 100644 (file)
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -340,7 +340,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                dev_hold(dev);
 
-               skb = sock_alloc_send_skb(sk, len+LL_RESERVED_SPACE(dev),
+               skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
                                          msg->msg_flags & MSG_DONTWAIT, &err);
                if (skb==NULL)
                        goto out_unlock;
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
 
+       memset(sec, 0, sizeof(*sec));
        mutex_lock(&econet_mutex);
 
        sk = sock->sk;
@@ -540,8 +541,7 @@ static void econet_destroy_timer(unsigned long data)
 {
        struct sock *sk=(struct sock *)data;
 
-       if (!atomic_read(&sk->sk_wmem_alloc) &&
-           !atomic_read(&sk->sk_rmem_alloc)) {
+       if (!sk_has_allocations(sk)) {
                sk_free(sk);
                return;
        }
@@ -573,16 +573,13 @@ static int econet_release(struct socket *sock)
 
        sk->sk_state_change(sk);        /* It is useless. Just for sanity. */
 
-       sock->sk = NULL;
-       sk->sk_socket = NULL;
-       sock_set_flag(sk, SOCK_DEAD);
+       sock_orphan(sk);
 
        /* Purge queues */
 
        skb_queue_purge(&sk->sk_receive_queue);
 
-       if (atomic_read(&sk->sk_rmem_alloc) ||
-           atomic_read(&sk->sk_wmem_alloc)) {
+       if (sk_has_allocations(sk)) {
                sk->sk_timer.data     = (unsigned long)sk;
                sk->sk_timer.expires  = jiffies + HZ;
                sk->sk_timer.function = econet_destroy_timer;
@@ -624,7 +621,7 @@ static int econet_create(struct net *net, struct socket *sock, int protocol)
        sock->state = SS_UNCONNECTED;
 
        err = -ENOBUFS;
-       sk = sk_alloc(net, PF_ECONET, GFP_KERNEL, &econet_proto, 1);
+       sk = sk_alloc(net, PF_ECONET, GFP_KERNEL, &econet_proto);
        if (sk == NULL)
                goto out;
 
@@ -903,15 +900,10 @@ static void aun_tx_ack(unsigned long seq, int result)
        struct ec_cb *eb;
 
        spin_lock_irqsave(&aun_queue_lock, flags);
-       skb = skb_peek(&aun_queue);
-       while (skb && skb != (struct sk_buff *)&aun_queue)
-       {
-               struct sk_buff *newskb = skb->next;
+       skb_queue_walk(&aun_queue, skb) {
                eb = (struct ec_cb *)&skb->cb;
                if (eb->seq == seq)
                        goto foundit;
-
-               skb = newskb;
        }
        spin_unlock_irqrestore(&aun_queue_lock, flags);
        printk(KERN_DEBUG "AUN: unknown sequence %ld\n", seq);
@@ -984,23 +976,18 @@ static void aun_data_available(struct sock *sk, int slen)
 
 static void ab_cleanup(unsigned long h)
 {
-       struct sk_buff *skb;
+       struct sk_buff *skb, *n;
        unsigned long flags;
 
        spin_lock_irqsave(&aun_queue_lock, flags);
-       skb = skb_peek(&aun_queue);
-       while (skb && skb != (struct sk_buff *)&aun_queue)
-       {
-               struct sk_buff *newskb = skb->next;
+       skb_queue_walk_safe(&aun_queue, skb, n) {
                struct ec_cb *eb = (struct ec_cb *)&skb->cb;
-               if ((jiffies - eb->start) > eb->timeout)
-               {
+               if ((jiffies - eb->start) > eb->timeout) {
                        tx_result(skb->sk, eb->cookie,
                                  ECTYPE_TRANSMIT_NOT_PRESENT);
                        skb_unlink(skb, &aun_queue);
                        kfree_skb(skb);
                }
-               skb = newskb;
        }
        spin_unlock_irqrestore(&aun_queue_lock, flags);
 
@@ -1014,9 +1001,8 @@ static int __init aun_udp_initialise(void)
 
        skb_queue_head_init(&aun_queue);
        spin_lock_init(&aun_queue_lock);
-       init_timer(&ab_cleanup_timer);
+       setup_timer(&ab_cleanup_timer, ab_cleanup, 0);
        ab_cleanup_timer.expires = jiffies + (HZ*2);
-       ab_cleanup_timer.function = ab_cleanup;
        add_timer(&ab_cleanup_timer);
 
        memset(&sin, 0, sizeof(sin));
@@ -1065,7 +1051,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
        struct sock *sk;
        struct ec_device *edev = dev->ec_ptr;
 
-       if (dev->nd_net != &init_net)
+       if (!net_eq(dev_net(dev), &init_net))
                goto drop;
 
        if (skb->pkt_type == PACKET_OTHERHOST)
@@ -1087,7 +1073,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                skb->protocol = htons(ETH_P_IP);
                skb_pull(skb, sizeof(struct ec_framehdr));
                netif_rx(skb);
-               return 0;
+               return NET_RX_SUCCESS;
        }
 
        sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net);
@@ -1098,15 +1084,15 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                            hdr->port))
                goto drop;
 
-       return 0;
+       return NET_RX_SUCCESS;
 
 drop:
        kfree_skb(skb);
        return NET_RX_DROP;
 }
 
-static struct packet_type econet_packet_type = {
-       .type =         __constant_htons(ETH_P_ECONET),
+static struct packet_type econet_packet_type __read_mostly = {
+       .type =         cpu_to_be16(ETH_P_ECONET),
        .func =         econet_rcv,
 };
 
@@ -1122,7 +1108,7 @@ static int econet_notifier(struct notifier_block *this, unsigned long msg, void
        struct net_device *dev = (struct net_device *)data;
        struct ec_device *edev;
 
-       if (dev->nd_net != &init_net)
+       if (!net_eq(dev_net(dev), &init_net))
                return NOTIFY_DONE;
 
        switch (msg) {