Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8db09f26 authored by Roel Kluin's avatar Roel Kluin Committed by David S. Miller
Browse files

x25: '< 0' and '>= 0' test on unsigned 



skb->len is an unsigned int, so the test in x25_rx_call_request() always
evaluates to true.

len in x25_sendmsg() is unsigned as well. so -ERRORS returned by x25_output()
are not noticed.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 73ce7b01

net/x25/af_x25.c

+5 −6
Original line number Diff line number Diff line
@@ -951,10 +951,8 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb, 
	/*

	 *	Incoming Call User Data.

	 */

	if (skb->len >= 0) {

	skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);

	makex25->calluserdata.cudlength = skb->len;

	}



	sk->sk_ack_backlog++;
@@ -1122,8 +1120,9 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock, 
	if (msg->msg_flags & MSG_OOB)

		skb_queue_tail(&x25->interrupt_out_queue, skb);

	else {

		len = x25_output(sk, skb);

		if (len < 0)

		rc = x25_output(sk, skb);

		len = rc;

		if (rc < 0)

			kfree_skb(skb);

		else if (x25->qbitincl)

			len++;