From eb4becd5e54d54a1e0881773cc568ecb9350a527 Mon Sep 17 00:00:00 2001
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Fri, 27 Mar 2009 00:28:21 -0700
Subject: [PATCH] --- yaml --- r: 136063 b: refs/heads/master c:
 83e0bbcbe2145f160fbaa109b0439dae7f4a38a9 h: refs/heads/master i:   136061:
 1681fe9f27bd33b2a1fd51b96b5e3a33c10063d2   136059:
 64342ee56ffd5669bf63c63ebe92881624bdeab4   136055:
 4e0edc3490e91e16234e8575518ce74355ac26cb   136047:
 e78b8b54cea60bc7d59a42a3c66340325b38e8ac   136031:
 a83b5607c5af65b98616c2b35608802189e97c4e   135999:
 a58e903c1f77c18ae91a48399290e08ad8935227   135935:
 1b738d1dd840094817a68aa3c4004030debf3fa2 v: v3

---
 [refs]                       | 2 +-
 trunk/net/netrom/af_netrom.c | 6 +++++-
 trunk/net/rose/af_rose.c     | 4 ++++
 trunk/net/x25/af_x25.c       | 6 ++++++
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index b92b7405c725..90228650a1f6 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 03ba999117eb8688252f9068356b6e028c2c3a56
+refs/heads/master: 83e0bbcbe2145f160fbaa109b0439dae7f4a38a9
diff --git a/trunk/net/netrom/af_netrom.c b/trunk/net/netrom/af_netrom.c
index 6d9c58ec56ac..d1c16bbee932 100644
--- a/trunk/net/netrom/af_netrom.c
+++ b/trunk/net/netrom/af_netrom.c
@@ -1086,7 +1086,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
 
 	SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
 
-	/* Build a packet */
+	/* Build a packet - the conventional user limit is 236 bytes. We can
+	   do ludicrously large NetROM frames but must not overflow */
+	if (len > 65536)
+		return -EMSGSIZE;
+
 	SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
 	size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 
diff --git a/trunk/net/rose/af_rose.c b/trunk/net/rose/af_rose.c
index 650139626581..0f36e8d59b29 100644
--- a/trunk/net/rose/af_rose.c
+++ b/trunk/net/rose/af_rose.c
@@ -1124,6 +1124,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
 
 	/* Build a packet */
 	SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
+	/* Sanity check the packet size */
+	if (len > 65535)
+		return -EMSGSIZE;
+
 	size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
 
 	if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
diff --git a/trunk/net/x25/af_x25.c b/trunk/net/x25/af_x25.c
index 9ca17b1ce52e..ed80af8ca5fb 100644
--- a/trunk/net/x25/af_x25.c
+++ b/trunk/net/x25/af_x25.c
@@ -1035,6 +1035,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
 		sx25.sx25_addr   = x25->dest_addr;
 	}
 
+	/* Sanity check the packet size */
+	if (len > 65535) {
+		rc = -EMSGSIZE;
+		goto out;
+	}
+
 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
 
 	/* Build a packet */