1 files changed, 17 insertions, 11 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 113c175f1715..f6a92a0b7aa6 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1275,7 +1275,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
         skb->protocol = htons(ETH_P_IP);
         skb_pull(skb, 13);
         skb->dev   = dev;
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
 
         stats = dev->priv;
         stats->rx_packets++;
@@ -1383,10 +1383,10 @@ free_it:
  *      @pt - packet type
  *
  *      Receive a packet (in skb) from device dev. This has come from the SNAP
- *      decoder, and on entry skb->h.raw is the DDP header, skb->len is the DDP
- *      header, skb->len is the DDP length. The physical headers have been
- *      extracted. PPP should probably pass frames marked as for this layer.
- *      [ie ARPHRD_ETHERTALK]
+ *      decoder, and on entry skb->transport_header is the DDP header, skb->len
+ *      is the DDP header, skb->len is the DDP length. The physical headers
+ *      have been extracted. PPP should probably pass frames marked as for this
+ *      layer.  [ie ARPHRD_ETHERTALK]
  */
 static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
                      struct packet_type *pt, struct net_device *orig_dev)
@@ -1417,10 +1417,13 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         /*
          * Size check to see if ddp->deh_len was crap
          * (Otherwise we'll detonate most spectacularly
-         * in the middle of recvmsg()).
+         * in the middle of atalk_checksum() or recvmsg()).
          */
-        if (skb->len < sizeof(*ddp))
+        if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
+                pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
+                         "skb->len=%u)\n", len_hops & 1023, skb->len);
                 goto freeit;
+        }
 
         /*
          * Any checksums. Note we don't do htons() on this == is assumed to be
@@ -1481,7 +1484,7 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
                      struct packet_type *pt, struct net_device *orig_dev)
 {
         /* Expand any short form frames */
-        if (skb->mac.raw[2] == 1) {
+        if (skb_mac_header(skb)[2] == 1) {
                 struct ddpehdr *ddp;
                 /* Find our address */
                 struct atalk_addr *ap = atalk_find_dev_addr(dev);
@@ -1507,8 +1510,8 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
                  * we write the network numbers !
                  */
 
-                ddp->deh_dnode = skb->mac.raw[0];     /* From physical header */
-                ddp->deh_snode = skb->mac.raw[1];     /* From physical header */
+                ddp->deh_dnode = skb_mac_header(skb)[0];     /* From physical header */
+                ddp->deh_snode = skb_mac_header(skb)[1];     /* From physical header */
 
                 ddp->deh_dnet  = ap->s_net;     /* Network number */
                 ddp->deh_snet  = ap->s_net;
@@ -1519,7 +1522,7 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
                 /* Non routable, so force a drop if we slip up later */
                 ddp->deh_len_hops = htons(skb->len + (DDP_MAXHOPS << 10));
         }
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
 
         return atalk_rcv(skb, dev, pt, orig_dev);
 freeit:
@@ -1768,6 +1771,9 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 case SIOCGSTAMP:
                         rc = sock_get_timestamp(sk, argp);
                         break;
+                case SIOCGSTAMPNS:
+                        rc = sock_get_timestampns(sk, argp);
+                        break;
                 /* Routing */
                 case SIOCADDRT:
                 case SIOCDELRT: