net: Fix use after free by removing length arg from sk_data_ready callbacks.

[linux.git] / net / decnet / dn_nsp_in.c

diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index c344163e6ac0e7bef952e25280601b60d2f74dbe..fe5f01485d3370ba4d645e4e640f073a1e26e41c 100644 (file)
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -585,7 +585,6 @@ out:
 static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig, struct sk_buff_head *queue)
 {
        int err;
-       int skb_len;
 
        /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
           number of warnings when compiling with -W --ANK
@@ -600,12 +599,11 @@ static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig
        if (err)
                goto out;
 
-       skb_len = skb->len;
        skb_set_owner_r(skb, sk);
        skb_queue_tail(queue, skb);
 
        if (!sock_flag(sk, SOCK_DEAD))
-               sk->sk_data_ready(sk, skb_len);
+               sk->sk_data_ready(sk);
 out:
        return err;
 }