From f563e246dc791a9f5efb5bbd9a9ab50cc67656f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?YOSHIFUJI=20Hideaki=20/=20=E5=90=89=E8=97=A4=E8=8B=B1?=
 =?UTF-8?q?=E6=98=8E?= <yoshfuji@linux-ipv6.org>
Date: Mon, 25 Mar 2013 08:25:38 +0000
Subject: [PATCH] --- yaml --- r: 368671 b: refs/heads/master c:
 18406d7e42a67d7b3a3b3ed17be6626a51d8c715 h: refs/heads/master i:   368669:
 5bc05196398061b7f2490e956b13bc2329daffb3   368667:
 7ef936223163f4515add08fc407b2e7989e03531   368663:
 aab5e280f290bf8bf64378ecec3522e65bc7fc07   368655:
 b3f968c23ddee3b35d2ad013e39c75578155ec5f   368639:
 ff4a465ba38176aa367ab3b50ff460f3fac2aee4 v: v3

---
 [refs]                       |  2 +-
 trunk/drivers/firewire/net.c | 21 +++++++++++++++++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index ddb5bf638a6b..001e62155a4d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b8092861efd827deb8d84292674704ee8bf41b04
+refs/heads/master: 18406d7e42a67d7b3a3b3ed17be6626a51d8c715
diff --git a/trunk/drivers/firewire/net.c b/trunk/drivers/firewire/net.c
index c1898adeb900..d438c5be8c21 100644
--- a/trunk/drivers/firewire/net.c
+++ b/trunk/drivers/firewire/net.c
@@ -517,6 +517,14 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
 	int status;
 	__be64 guid;
 
+	switch (ether_type) {
+	case ETH_P_ARP:
+	case ETH_P_IP:
+		break;
+	default:
+		goto err;
+	}
+
 	dev = netdev_priv(net);
 	/* Write metadata, and then pass to the receive level */
 	skb->dev = net;
@@ -653,6 +661,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
 	return 0;
 
  no_peer:
+ err:
 	net->stats.rx_errors++;
 	net->stats.rx_dropped++;
 
@@ -1340,9 +1349,17 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
 	 * We might need to rebuild the header on tx failure.
 	 */
 	memcpy(&hdr_buf, skb->data, sizeof(hdr_buf));
-	skb_pull(skb, sizeof(hdr_buf));
-
 	proto = hdr_buf.h_proto;
+
+	switch (proto) {
+	case htons(ETH_P_ARP):
+	case htons(ETH_P_IP):
+		break;
+	default:
+		goto fail;
+	}
+
+	skb_pull(skb, sizeof(hdr_buf));
 	dg_size = skb->len;
 
 	/*