diff options
author | Eric Dumazet <eric.dumazet@gmail.com> | 2011-11-27 19:27:47 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2011-11-28 18:58:24 -0500 |
commit | 690e99c4ba73fc18643b38fa032022b8758ad4d3 (patch) | |
tree | 73745636f1b9cab69eb2738f84f4b0d4cb36db5f /net/ipv4/tcp.c | |
parent | 8b7ff200010600ef7cd9d002f9f8f97edfc7578e (diff) |
tcp: tcp_sendmsg() wrong access to sk_route_caps
Now sk_route_caps is u64, its dangerous to use an integer to store
result of an AND operator. It wont work if NETIF_F_SG is moved on the
upper part of u64.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp.c')
-rw-r--r-- | net/ipv4/tcp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 50c359645665..ecbc89a0436b 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c | |||
@@ -891,7 +891,7 @@ EXPORT_SYMBOL(tcp_sendpage); | |||
891 | #define TCP_PAGE(sk) (sk->sk_sndmsg_page) | 891 | #define TCP_PAGE(sk) (sk->sk_sndmsg_page) |
892 | #define TCP_OFF(sk) (sk->sk_sndmsg_off) | 892 | #define TCP_OFF(sk) (sk->sk_sndmsg_off) |
893 | 893 | ||
894 | static inline int select_size(const struct sock *sk, int sg) | 894 | static inline int select_size(const struct sock *sk, bool sg) |
895 | { | 895 | { |
896 | const struct tcp_sock *tp = tcp_sk(sk); | 896 | const struct tcp_sock *tp = tcp_sk(sk); |
897 | int tmp = tp->mss_cache; | 897 | int tmp = tp->mss_cache; |
@@ -917,9 +917,9 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | |||
917 | struct iovec *iov; | 917 | struct iovec *iov; |
918 | struct tcp_sock *tp = tcp_sk(sk); | 918 | struct tcp_sock *tp = tcp_sk(sk); |
919 | struct sk_buff *skb; | 919 | struct sk_buff *skb; |
920 | int iovlen, flags; | 920 | int iovlen, flags, err, copied; |
921 | int mss_now, size_goal; | 921 | int mss_now, size_goal; |
922 | int sg, err, copied; | 922 | bool sg; |
923 | long timeo; | 923 | long timeo; |
924 | 924 | ||
925 | lock_sock(sk); | 925 | lock_sock(sk); |
@@ -946,7 +946,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | |||
946 | if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) | 946 | if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) |
947 | goto out_err; | 947 | goto out_err; |
948 | 948 | ||
949 | sg = sk->sk_route_caps & NETIF_F_SG; | 949 | sg = !!(sk->sk_route_caps & NETIF_F_SG); |
950 | 950 | ||
951 | while (--iovlen >= 0) { | 951 | while (--iovlen >= 0) { |
952 | size_t seglen = iov->iov_len; | 952 | size_t seglen = iov->iov_len; |