loop: fix NULL dereference if mount fails

[safe/jmp/linux-2.6] / net / netrom / nr_subr.c

diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 587bed2..04e7d0d 100644 (file)
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -11,7 +11,6 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
 #include <linux/sockios.h>
@@ -57,7 +56,7 @@ void nr_frames_acked(struct sock *sk, unsigned short nr)
         */
        if (nrom->va != nr) {
                while (skb_peek(&nrom->ack_queue) != NULL && nrom->va != nr) {
-                       skb = skb_dequeue(&nrom->ack_queue);
+                       skb = skb_dequeue(&nrom->ack_queue);
                        kfree_skb(skb);
                        nrom->va = (nrom->va + 1) % NR_MODULUS;
                }
@@ -210,10 +209,9 @@ void nr_write_internal(struct sock *sk, int frametype)
 }
 
 /*
- * This routine is called when a Connect Acknowledge with the Choke Flag
- * set is needed to refuse a connection.
+ * This routine is called to send an error reply.
  */
-void nr_transmit_refusal(struct sk_buff *skb, int mine)
+void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags)
 {
        struct sk_buff *skbn;
        unsigned char *dptr;
@@ -228,13 +226,13 @@ void nr_transmit_refusal(struct sk_buff *skb, int mine)
 
        dptr = skb_put(skbn, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
 
-       memcpy(dptr, skb->data + 7, AX25_ADDR_LEN);
+       skb_copy_from_linear_data_offset(skb, 7, dptr, AX25_ADDR_LEN);
        dptr[6] &= ~AX25_CBIT;
        dptr[6] &= ~AX25_EBIT;
        dptr[6] |= AX25_SSSID_SPARE;
        dptr += AX25_ADDR_LEN;
 
-       memcpy(dptr, skb->data + 0, AX25_ADDR_LEN);
+       skb_copy_from_linear_data(skb, dptr, AX25_ADDR_LEN);
        dptr[6] &= ~AX25_CBIT;
        dptr[6] |= AX25_EBIT;
        dptr[6] |= AX25_SSSID_SPARE;
@@ -254,7 +252,7 @@ void nr_transmit_refusal(struct sk_buff *skb, int mine)
                *dptr++ = 0;
        }
 
-       *dptr++ = NR_CONNACK | NR_CHOKE_FLAG;
+       *dptr++ = cmdflags;
        *dptr++ = 0;
 
        if (!nr_route_frame(skbn, NULL))