diff options
Diffstat (limited to 'net/ax25')
| -rw-r--r-- | net/ax25/ax25_addr.c | 6 | ||||
| -rw-r--r-- | net/ax25/ax25_out.c | 2 | ||||
| -rw-r--r-- | net/ax25/ax25_route.c | 2 |
3 files changed, 6 insertions, 4 deletions
diff --git a/net/ax25/ax25_addr.c b/net/ax25/ax25_addr.c index 9162409559c..e7c9b0ea17a 100644 --- a/net/ax25/ax25_addr.c +++ b/net/ax25/ax25_addr.c @@ -189,8 +189,10 @@ const unsigned char *ax25_addr_parse(const unsigned char *buf, int len, digi->ndigi = 0; while (!(buf[-1] & AX25_EBIT)) { - if (d >= AX25_MAX_DIGIS) return NULL; /* Max of 6 digis */ - if (len < 7) return NULL; /* Short packet */ + if (d >= AX25_MAX_DIGIS) + return NULL; + if (len < AX25_ADDR_LEN) + return NULL; memcpy(&digi->calls[d], buf, AX25_ADDR_LEN); digi->ndigi = d + 1; diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c index be8a25e0db6..be2acab9be9 100644 --- a/net/ax25/ax25_out.c +++ b/net/ax25/ax25_out.c @@ -350,7 +350,7 @@ void ax25_transmit_buffer(ax25_cb *ax25, struct sk_buff *skb, int type) if (skb->sk != NULL) skb_set_owner_w(skbn, skb->sk); - kfree_skb(skb); + consume_skb(skb); skb = skbn; } diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c index a65588040b9..d39097737e3 100644 --- a/net/ax25/ax25_route.c +++ b/net/ax25/ax25_route.c @@ -474,7 +474,7 @@ struct sk_buff *ax25_rt_build_path(struct sk_buff *skb, ax25_address *src, if (skb->sk != NULL) skb_set_owner_w(skbn, skb->sk); - kfree_skb(skb); + consume_skb(skb); skb = skbn; } |