skb->sk is used in dev_pick_tx() which is called from dev_queue_xmit(). If

skb->sk is used in dev_pick_tx() which is called from dev_queue_xmit(). If
sk points to an arbitrary magic value, dev_pick_tx() returns a wrong value,
which can lead to various memory corruption bugs.

In commit a4ee3ce3293dc931fab19beb472a8bde1295aebe dev_pick_tx() was
changed  to look the new field in socket called sk_tx_queue_mapping.

Original patch provided by Michal Sojka <sojkam1@fel.cvut.cz>

git-svn-id: svn://svn.berlios.de//socketcan/trunk@1223 030b6a49-0b11-0410-94ab-b0dab22257f2