aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--net/8021q/vlan.c3
-rw-r--r--net/dccp/probe.c2
-rw-r--r--net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c3
-rw-r--r--net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c3
-rw-r--r--net/sched/act_pedit.c3
-rw-r--r--net/sctp/debug.c8
-rw-r--r--net/sctp/sm_statetable.c2
-rw-r--r--net/wanrouter/wanmain.c2
8 files changed, 7 insertions, 19 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index ceef57c9ab32..de78c9dd713b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -736,8 +736,7 @@ static int vlan_ioctl_handler(void __user *arg)
736 case SET_VLAN_NAME_TYPE_CMD: 736 case SET_VLAN_NAME_TYPE_CMD:
737 if (!capable(CAP_NET_ADMIN)) 737 if (!capable(CAP_NET_ADMIN))
738 return -EPERM; 738 return -EPERM;
739 if ((args.u.name_type >= 0) && 739 if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
740 (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
741 vlan_name_type = args.u.name_type; 740 vlan_name_type = args.u.name_type;
742 err = 0; 741 err = 0;
743 } else { 742 } else {
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 1f5e3ba62065..43a3adb027e7 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -128,7 +128,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
128 int error = 0, cnt = 0; 128 int error = 0, cnt = 0;
129 unsigned char *tbuf; 129 unsigned char *tbuf;
130 130
131 if (!buf || len < 0) 131 if (!buf)
132 return -EINVAL; 132 return -EINVAL;
133 133
134 if (len == 0) 134 if (len == 0)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6d2a08205111..dc442fb791b0 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -177,8 +177,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
177 177
178 protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum, 178 protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
179 (*pskb)->len - extoff); 179 (*pskb)->len - extoff);
180 if (protoff < 0 || protoff > (*pskb)->len || 180 if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
181 pnum == NEXTHDR_FRAGMENT) {
182 DEBUGP("proto header not found\n"); 181 DEBUGP("proto header not found\n");
183 return NF_ACCEPT; 182 return NF_ACCEPT;
184 } 183 }
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 0be790d250f9..8814b95b2326 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -168,8 +168,7 @@ icmpv6_error_message(struct sk_buff *skb,
168 skb->len - inip6off 168 skb->len - inip6off
169 - sizeof(struct ipv6hdr)); 169 - sizeof(struct ipv6hdr));
170 170
171 if ((inprotoff < 0) || (inprotoff > skb->len) || 171 if ((inprotoff > skb->len) || (inprotonum == NEXTHDR_FRAGMENT)) {
172 (inprotonum == NEXTHDR_FRAGMENT)) {
173 DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n"); 172 DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n");
174 return -NF_ACCEPT; 173 return -NF_ACCEPT;
175 } 174 }
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 45b3cda86a21..6f8684b5617e 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -164,8 +164,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
164 printk("offset must be on 32 bit boundaries\n"); 164 printk("offset must be on 32 bit boundaries\n");
165 goto bad; 165 goto bad;
166 } 166 }
167 if (skb->len < 0 || 167 if (offset > 0 && offset > skb->len) {
168 (offset > 0 && offset > skb->len)) {
169 printk("offset %d cant exceed pkt length %d\n", 168 printk("offset %d cant exceed pkt length %d\n",
170 offset, skb->len); 169 offset, skb->len);
171 goto bad; 170 goto bad;
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index e8c0f7435d7f..80f70aa53386 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -77,8 +77,6 @@ static const char *sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = {
77/* Lookup "chunk type" debug name. */ 77/* Lookup "chunk type" debug name. */
78const char *sctp_cname(const sctp_subtype_t cid) 78const char *sctp_cname(const sctp_subtype_t cid)
79{ 79{
80 if (cid.chunk < 0)
81 return "illegal chunk id";
82 if (cid.chunk <= SCTP_CID_BASE_MAX) 80 if (cid.chunk <= SCTP_CID_BASE_MAX)
83 return sctp_cid_tbl[cid.chunk]; 81 return sctp_cid_tbl[cid.chunk];
84 82
@@ -146,8 +144,6 @@ static const char *sctp_primitive_tbl[SCTP_NUM_PRIMITIVE_TYPES] = {
146/* Lookup primitive debug name. */ 144/* Lookup primitive debug name. */
147const char *sctp_pname(const sctp_subtype_t id) 145const char *sctp_pname(const sctp_subtype_t id)
148{ 146{
149 if (id.primitive < 0)
150 return "illegal primitive";
151 if (id.primitive <= SCTP_EVENT_PRIMITIVE_MAX) 147 if (id.primitive <= SCTP_EVENT_PRIMITIVE_MAX)
152 return sctp_primitive_tbl[id.primitive]; 148 return sctp_primitive_tbl[id.primitive];
153 return "unknown_primitive"; 149 return "unknown_primitive";
@@ -161,8 +157,6 @@ static const char *sctp_other_tbl[] = {
161/* Lookup "other" debug name. */ 157/* Lookup "other" debug name. */
162const char *sctp_oname(const sctp_subtype_t id) 158const char *sctp_oname(const sctp_subtype_t id)
163{ 159{
164 if (id.other < 0)
165 return "illegal 'other' event";
166 if (id.other <= SCTP_EVENT_OTHER_MAX) 160 if (id.other <= SCTP_EVENT_OTHER_MAX)
167 return sctp_other_tbl[id.other]; 161 return sctp_other_tbl[id.other];
168 return "unknown 'other' event"; 162 return "unknown 'other' event";
@@ -184,8 +178,6 @@ static const char *sctp_timer_tbl[] = {
184/* Lookup timer debug name. */ 178/* Lookup timer debug name. */
185const char *sctp_tname(const sctp_subtype_t id) 179const char *sctp_tname(const sctp_subtype_t id)
186{ 180{
187 if (id.timeout < 0)
188 return "illegal 'timer' event";
189 if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX) 181 if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
190 return sctp_timer_tbl[id.timeout]; 182 return sctp_timer_tbl[id.timeout];
191 return "unknown_timer"; 183 return "unknown_timer";
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 523071c7902f..70a91ece3c49 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -960,7 +960,7 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
960 if (state > SCTP_STATE_MAX) 960 if (state > SCTP_STATE_MAX)
961 return &bug; 961 return &bug;
962 962
963 if (cid >= 0 && cid <= SCTP_CID_BASE_MAX) 963 if (cid <= SCTP_CID_BASE_MAX)
964 return &chunk_event_table[cid][state]; 964 return &chunk_event_table[cid][state];
965 965
966 if (sctp_prsctp_enable) { 966 if (sctp_prsctp_enable) {
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 7a19e0ede289..849cc06bd914 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -454,7 +454,7 @@ static int wanrouter_device_setup(struct wan_device *wandev,
454 } 454 }
455 455
456 if (conf->data_size && conf->data) { 456 if (conf->data_size && conf->data) {
457 if (conf->data_size > 128000 || conf->data_size < 0) { 457 if (conf->data_size > 128000) {
458 printk(KERN_INFO 458 printk(KERN_INFO
459 "%s: ERROR, Invalid firmware data size %i !\n", 459 "%s: ERROR, Invalid firmware data size %i !\n",
460 wandev->name, conf->data_size); 460 wandev->name, conf->data_size);