net: Fix use after free by removing length arg from sk_data_ready callbacks.

[linux.git] / drivers / staging / lustre / lnet / klnds / socklnd / socklnd_lib-linux.c

diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
index 80141aa32c21dad0c14e90e392e4e886b4df27b7..a9b5898347c2bbe9f31481854e208eef80424a72 100644 (file)
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
@@ -373,7 +373,8 @@ ksocknal_lib_recv_kiov (ksock_conn_t *conn)
 
        /* NB we can't trust socket ops to either consume our iovs
         * or leave them alone. */
-       if ((addr = ksocknal_lib_kiov_vmap(kiov, niov, scratchiov, pages)) != NULL) {
+       addr = ksocknal_lib_kiov_vmap(kiov, niov, scratchiov, pages);
+       if (addr != NULL) {
                nob = scratchiov[0].iov_len;
                msg.msg_iovlen = 1;
 
@@ -654,7 +655,7 @@ extern void ksocknal_write_callback (ksock_conn_t *conn);
  * socket call back in Linux
  */
 static void
-ksocknal_data_ready (struct sock *sk, int n)
+ksocknal_data_ready (struct sock *sk)
 {
        ksock_conn_t  *conn;
 
@@ -665,7 +666,7 @@ ksocknal_data_ready (struct sock *sk, int n)
        conn = sk->sk_user_data;
        if (conn == NULL) {          /* raced with ksocknal_terminate_conn */
                LASSERT (sk->sk_data_ready != &ksocknal_data_ready);
-               sk->sk_data_ready (sk, n);
+               sk->sk_data_ready (sk);
        } else
                ksocknal_read_callback(conn);