1 files changed, 13 insertions, 8 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 9fc5b023d111..ed80af8ca5fb 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -951,10 +951,8 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         /*
          *      Incoming Call User Data.
          */
-        if (skb->len >= 0) {
-                skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
-                makex25->calluserdata.cudlength = skb->len;
-        }
+        skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
+        makex25->calluserdata.cudlength = skb->len;
 
         sk->sk_ack_backlog++;
 
@@ -1037,6 +1035,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
                 sx25.sx25_addr   = x25->dest_addr;
         }
 
+        /* Sanity check the packet size */
+        if (len > 65535) {
+                rc = -EMSGSIZE;
+                goto out;
+        }
+
         SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
 
         /* Build a packet */
@@ -1122,8 +1126,9 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (msg->msg_flags & MSG_OOB)
                 skb_queue_tail(&x25->interrupt_out_queue, skb);
         else {
-                len = x25_output(sk, skb);
-                if (len < 0)
+                rc = x25_output(sk, skb);
+                len = rc;
+                if (rc < 0)
                         kfree_skb(skb);
                 else if (x25->qbitincl)
                         len++;
@@ -1608,8 +1613,8 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
 
 SOCKOPS_WRAP(x25_proto, AF_X25);
 
-static struct packet_type x25_packet_type = {
-        .type = __constant_htons(ETH_P_X25),
+static struct packet_type x25_packet_type __read_mostly = {
+        .type = cpu_to_be16(ETH_P_X25),
         .func = x25_lapb_receive_frame,
 };