diff options
-rw-r--r-- | net/ipv6/raw.c | 4 | ||||
-rw-r--r-- | net/ipv6/udp.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 306d5d83c068..203e069e7fe9 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c | |||
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk, | |||
687 | int err; | 687 | int err; |
688 | 688 | ||
689 | /* Rough check on arithmetic overflow, | 689 | /* Rough check on arithmetic overflow, |
690 | better check is made in ip6_build_xmit | 690 | better check is made in ip6_append_data(). |
691 | */ | 691 | */ |
692 | if (len < 0) | 692 | if (len > INT_MAX) |
693 | return -EMSGSIZE; | 693 | return -EMSGSIZE; |
694 | 694 | ||
695 | /* Mirror BSD error message compatibility */ | 695 | /* Mirror BSD error message compatibility */ |
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 0ad471909881..f590db57a7c9 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c | |||
@@ -615,7 +615,7 @@ do_udp_sendmsg: | |||
615 | return udp_sendmsg(iocb, sk, msg, len); | 615 | return udp_sendmsg(iocb, sk, msg, len); |
616 | 616 | ||
617 | /* Rough check on arithmetic overflow, | 617 | /* Rough check on arithmetic overflow, |
618 | better check is made in ip6_build_xmit | 618 | better check is made in ip6_append_data(). |
619 | */ | 619 | */ |
620 | if (len > INT_MAX - sizeof(struct udphdr)) | 620 | if (len > INT_MAX - sizeof(struct udphdr)) |
621 | return -EMSGSIZE; | 621 | return -EMSGSIZE; |