Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

[platform/kernel/linux-starfive.git] / net / dsa / slave.c

diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index a9fde48..5fe075b 100644 (file)
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1852,6 +1852,7 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu)
        int new_master_mtu;
        int old_master_mtu;
        int mtu_limit;
+       int overhead;
        int cpu_mtu;
        int err;
 
@@ -1880,9 +1881,10 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu)
                        largest_mtu = slave_mtu;
        }
 
-       mtu_limit = min_t(int, master->max_mtu, dev->max_mtu);
+       overhead = dsa_tag_protocol_overhead(cpu_dp->tag_ops);
+       mtu_limit = min_t(int, master->max_mtu, dev->max_mtu + overhead);
        old_master_mtu = master->mtu;
-       new_master_mtu = largest_mtu + dsa_tag_protocol_overhead(cpu_dp->tag_ops);
+       new_master_mtu = largest_mtu + overhead;
        if (new_master_mtu > mtu_limit)
                return -ERANGE;
 
@@ -1917,8 +1919,7 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu)
 
 out_port_failed:
        if (new_master_mtu != old_master_mtu)
-               dsa_port_mtu_change(cpu_dp, old_master_mtu -
-                                   dsa_tag_protocol_overhead(cpu_dp->tag_ops));
+               dsa_port_mtu_change(cpu_dp, old_master_mtu - overhead);
 out_cpu_failed:
        if (new_master_mtu != old_master_mtu)
                dev_set_mtu(master, old_master_mtu);