1 files changed, 12 insertions, 2 deletions

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7e8ca2836452..8035fbf526ae 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
  *  -ENOBUFS on full driver queue (see net_xmit_errno())
  *  -ENOMEM when local loopback failed at calling skb_clone()
  *  -EPERM when trying to send on a non-CAN interface
+ *  -EINVAL when the skb->data does not contain a valid CAN frame
  */
 int can_send(struct sk_buff *skb, int loop)
 {
         struct sk_buff *newskb = NULL;
+        struct can_frame *cf = (struct can_frame *)skb->data;
         int err;
 
+        if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
         if (skb->dev->type != ARPHRD_CAN) {
                 kfree_skb(skb);
                 return -EPERM;
@@ -605,13 +612,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev)
 {
         struct dev_rcv_lists *d;
+        struct can_frame *cf = (struct can_frame *)skb->data;
         int matches;
 
-        if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {
+        if (dev->type != ARPHRD_CAN || !net_eq(dev_net(dev), &init_net)) {
                 kfree_skb(skb);
                 return 0;
         }
 
+        BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
+
         /* update statistics */
         can_stats.rx_frames++;
         can_stats.rx_frames_delta++;
@@ -718,7 +728,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
         struct net_device *dev = (struct net_device *)data;
         struct dev_rcv_lists *d;
 
-        if (dev_net(dev) != &init_net)
+        if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
 
         if (dev->type != ARPHRD_CAN)