summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorChristoph Jaeger <cj@linux.com>2015-01-11 13:01:16 -0500
committerDavid S. Miller <davem@davemloft.net>2015-01-11 21:54:03 -0500
commit46d2cfb192b30d729aef064808ed5ece47cee369 (patch)
tree94a98b40912ad217baaf9a462f56db788a91e4ed /net
parent7a05dc64e2e4c611d89007b125b20c0d2a4d31a5 (diff)
downloadlinux-46d2cfb192b30d729aef064808ed5ece47cee369.tar.bz2
packet: bail out of packet_snd() if L2 header creation fails
Due to a misplaced parenthesis, the expression (unlikely(offset) < 0), which expands to (__builtin_expect(!!(offset), 0) < 0), never evaluates to true. Therefore, when sending packets with PF_PACKET/SOCK_DGRAM, packet_snd() does not abort as intended if the creation of the layer 2 header fails. Spotted by Coverity - CID 1259975 ("Operands don't affect result"). Fixes: 9c7077622dd9 ("packet: make packet_snd fail on len smaller than l2 header") Signed-off-by: Christoph Jaeger <cj@linux.com> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: Willem de Bruijn <willemb@google.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/packet/af_packet.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6880f34a529a..9cfe2e1dd8b5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2517,7 +2517,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
err = -EINVAL;
if (sock->type == SOCK_DGRAM) {
offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
- if (unlikely(offset) < 0)
+ if (unlikely(offset < 0))
goto out_free;
} else {
if (ll_header_truncated(dev, len))