diff options
-rw-r--r-- | drivers/connector/connector.c | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index d7373ca69c99..25693b045371 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c | |||
@@ -179,26 +179,21 @@ static int cn_call_callback(struct sk_buff *skb) | |||
179 | * | 179 | * |
180 | * It checks skb, netlink header and msg sizes, and calls callback helper. | 180 | * It checks skb, netlink header and msg sizes, and calls callback helper. |
181 | */ | 181 | */ |
182 | static void cn_rx_skb(struct sk_buff *__skb) | 182 | static void cn_rx_skb(struct sk_buff *skb) |
183 | { | 183 | { |
184 | struct nlmsghdr *nlh; | 184 | struct nlmsghdr *nlh; |
185 | struct sk_buff *skb; | ||
186 | int len, err; | 185 | int len, err; |
187 | 186 | ||
188 | skb = skb_get(__skb); | ||
189 | |||
190 | if (skb->len >= NLMSG_HDRLEN) { | 187 | if (skb->len >= NLMSG_HDRLEN) { |
191 | nlh = nlmsg_hdr(skb); | 188 | nlh = nlmsg_hdr(skb); |
192 | len = nlmsg_len(nlh); | 189 | len = nlmsg_len(nlh); |
193 | 190 | ||
194 | if (len < (int)sizeof(struct cn_msg) || | 191 | if (len < (int)sizeof(struct cn_msg) || |
195 | skb->len < nlh->nlmsg_len || | 192 | skb->len < nlh->nlmsg_len || |
196 | len > CONNECTOR_MAX_MSG_SIZE) { | 193 | len > CONNECTOR_MAX_MSG_SIZE) |
197 | kfree_skb(skb); | ||
198 | return; | 194 | return; |
199 | } | ||
200 | 195 | ||
201 | err = cn_call_callback(skb); | 196 | err = cn_call_callback(skb_get(skb)); |
202 | if (err < 0) | 197 | if (err < 0) |
203 | kfree_skb(skb); | 198 | kfree_skb(skb); |
204 | } | 199 | } |