From 716c85b97b8095342e84d8eef68cf42fc5a2198e Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 21 Aug 2007 00:06:37 -0700
Subject: [PATCH] --- yaml --- r: 64205 b: refs/heads/master c:
 d92a7db710c32db826a00ba9bc7a22e741d5041e h: refs/heads/master i:   64203:
 70611d5937115d8de6735956db1ac10aa67226c3 v: v3

---
 [refs]                |  2 +-
 trunk/net/802/psnap.c | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/[refs] b/[refs]
index 2606254b10ec..70be4d1845cb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 39dad26c37fdb1382e4173172a2704fa278f7fd6
+refs/heads/master: d92a7db710c32db826a00ba9bc7a22e741d5041e
diff --git a/trunk/net/802/psnap.c b/trunk/net/802/psnap.c
index 04ee43e7538f..31128cb92a23 100644
--- a/trunk/net/802/psnap.c
+++ b/trunk/net/802/psnap.c
@@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
 		.type = __constant_htons(ETH_P_SNAP),
 	};
 
+	if (unlikely(!pskb_may_pull(skb, 5)))
+		goto drop;
+
 	rcu_read_lock();
 	proto = find_snap_client(skb_transport_header(skb));
 	if (proto) {
@@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
 		skb->transport_header += 5;
 		skb_pull_rcsum(skb, 5);
 		rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev);
-	} else {
-		skb->sk = NULL;
-		kfree_skb(skb);
-		rc = 1;
 	}
-
 	rcu_read_unlock();
+
+	if (unlikely(!proto))
+		goto drop;
+
+out:
 	return rc;
+
+drop:
+	kfree_skb(skb);
+	goto out;
 }
 
 /*