NFC: llcp: Remove possible double call to kfree_skb

[deliverable/linux.git] / net / nfc / llcp / sock.c

diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index fea22eb41b8242a1fb80d22c6aa2ca6515d78d0e..e488e440186aff11305785c9aa2025a6432f1724 100644 (file)
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -278,6 +278,8 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 
                        pr_debug("Returning sk state %d\n", sk->sk_state);
 
+                       sk_acceptq_removed(parent);
+
                        return sk;
                }
 
@@ -462,8 +464,6 @@ static int llcp_sock_release(struct socket *sock)
                        nfc_llcp_accept_unlink(accept_sk);
 
                        release_sock(accept_sk);
-
-                       sock_orphan(accept_sk);
                }
        }
 
@@ -672,25 +672,27 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        copied = min_t(unsigned int, rlen, len);
 
        cskb = skb;
-       if (memcpy_toiovec(msg->msg_iov, cskb->data, copied)) {
+       if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
                if (!(flags & MSG_PEEK))
                        skb_queue_head(&sk->sk_receive_queue, skb);
                return -EFAULT;
        }
 
+       sock_recv_timestamp(msg, sk, skb);
+
        if (sk->sk_type == SOCK_DGRAM && msg->msg_name) {
                struct nfc_llcp_ui_cb *ui_cb = nfc_llcp_ui_skb_cb(skb);
-               struct sockaddr_nfc_llcp sockaddr;
+               struct sockaddr_nfc_llcp *sockaddr =
+                       (struct sockaddr_nfc_llcp *) msg->msg_name;
 
-               pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
+               msg->msg_namelen = sizeof(struct sockaddr_nfc_llcp);
 
-               sockaddr.sa_family = AF_NFC;
-               sockaddr.nfc_protocol = NFC_PROTO_NFC_DEP;
-               sockaddr.dsap = ui_cb->dsap;
-               sockaddr.ssap = ui_cb->ssap;
+               pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
 
-               memcpy(msg->msg_name, &sockaddr, sizeof(sockaddr));
-               msg->msg_namelen = sizeof(sockaddr);
+               sockaddr->sa_family = AF_NFC;
+               sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
+               sockaddr->dsap = ui_cb->dsap;
+               sockaddr->ssap = ui_cb->ssap;
        }
 
        /* Mark read part of skb as used */
@@ -806,7 +808,6 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
        llcp_sock->reserved_ssap = LLCP_SAP_MAX;
        skb_queue_head_init(&llcp_sock->tx_queue);
        skb_queue_head_init(&llcp_sock->tx_pending_queue);
-       skb_queue_head_init(&llcp_sock->tx_backlog_queue);
        INIT_LIST_HEAD(&llcp_sock->accept_queue);
 
        if (sock != NULL)
@@ -821,7 +822,6 @@ void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 
        skb_queue_purge(&sock->tx_queue);
        skb_queue_purge(&sock->tx_pending_queue);
-       skb_queue_purge(&sock->tx_backlog_queue);
 
        list_del_init(&sock->accept_queue);