1 files changed, 13 insertions, 27 deletions

diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index f17b65af9c9..9ea0c933b9f 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -29,6 +29,7 @@
 #include <linux/if_ether.h>
 #include <linux/netdevice.h>
 #include <linux/irda.h>
+#include <linux/slab.h>
 
 #include <net/pkt_sched.h>
 #include <net/sock.h>
@@ -543,7 +544,7 @@ static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self,
 		/*
 		 *  We now have some discovery info to deliver!
 		 */
-		discovery = kmalloc(sizeof(discovery_t), GFP_ATOMIC);
+		discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC);
 		if (!discovery) {
 			IRDA_WARNING("%s: unable to malloc!\n", __func__);
 			return;
@@ -847,7 +848,7 @@ void irlap_send_data_primary_poll(struct irlap_cb *self, struct sk_buff *skb)
 	 * though IrLAP is currently sending the *last* frame of the
 	 * tx-window, the driver most likely has only just started
 	 * sending the *first* frame of the same tx-window.
-	 * I.e. we are always at the very begining of or Tx window.
+	 * I.e. we are always at the very beginning of or Tx window.
 	 * Now, we are supposed to set the final timer from the end
 	 * of our tx-window to let the other peer reply. So, we need
 	 * to add extra time to compensate for the fact that we
@@ -982,17 +983,12 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
 {
 	struct sk_buff *tx_skb;
 	struct sk_buff *skb;
-	int count;
 
 	IRDA_ASSERT(self != NULL, return;);
 	IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
-	/* Initialize variables */
-	count = skb_queue_len(&self->wx_list);
-
 	/*  Resend unacknowledged frame(s) */
-	skb = skb_peek(&self->wx_list);
-	while (skb != NULL) {
+	skb_queue_walk(&self->wx_list, skb) {
 		irlap_wait_min_turn_around(self, &self->qos_tx);
 
 		/* We copy the skb to be retransmitted since we will have to
@@ -1011,21 +1007,12 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
 		/*
 		 *  Set poll bit on the last frame retransmitted
 		 */
-		if (count-- == 1)
+		if (skb_queue_is_last(&self->wx_list, skb))
 			tx_skb->data[1] |= PF_BIT; /* Set p/f bit */
 		else
 			tx_skb->data[1] &= ~PF_BIT; /* Clear p/f bit */
 
 		irlap_send_i_frame(self, tx_skb, command);
-
-		/*
-		 *  If our skb is the last buffer in the list, then
-		 *  we are finished, if not, move to the next sk-buffer
-		 */
-		if (skb == skb_peek_tail(&self->wx_list))
-			skb = NULL;
-		else
-			skb = skb->next;
 	}
 #if 0 /* Not yet */
 	/*
@@ -1325,6 +1312,7 @@ int irlap_driver_rcv(struct sk_buff *skb, struct net_device *dev,
 	struct irlap_cb *self;
 	int command;
 	__u8 control;
+	int ret = -1;
 
 	if (!net_eq(dev_net(dev), &init_net))
 		goto out;
@@ -1333,25 +1321,21 @@ int irlap_driver_rcv(struct sk_buff *skb, struct net_device *dev,
 	self = (struct irlap_cb *) dev->atalk_ptr;
 
 	/* If the net device is down, then IrLAP is gone! */
-	if (!self || self->magic != LAP_MAGIC) {
-		dev_kfree_skb(skb);
-		return -1;
-	}
+	if (!self || self->magic != LAP_MAGIC)
+		goto err;
 
 	/* We are no longer an "old" protocol, so we need to handle
 	 * share and non linear skbs. This should never happen, so
 	 * we don't need to be clever about it. Jean II */
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
 		IRDA_ERROR("%s: can't clone shared skb!\n", __func__);
-		dev_kfree_skb(skb);
-		return -1;
+		goto err;
 	}
 
 	/* Check if frame is large enough for parsing */
 	if (!pskb_may_pull(skb, 2)) {
 		IRDA_ERROR("%s: frame too short!\n", __func__);
-		dev_kfree_skb(skb);
-		return -1;
+		goto err;
 	}
 
 	command    = skb->data[0] & CMD_FRAME;
@@ -1442,7 +1426,9 @@ int irlap_driver_rcv(struct sk_buff *skb, struct net_device *dev,
 		break;
 	}
 out:
+	ret = 0;
+err:
 	/* Always drop our reference on the skb */
 	dev_kfree_skb(skb);
-	return 0;
+	return ret;
 }