diff options
Diffstat (limited to 'net')
-rw-r--r-- | net/8021q/vlan.c | 3 | ||||
-rw-r--r-- | net/dccp/probe.c | 2 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 3 | ||||
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 3 | ||||
-rw-r--r-- | net/sched/act_pedit.c | 3 | ||||
-rw-r--r-- | net/sctp/debug.c | 8 | ||||
-rw-r--r-- | net/sctp/sm_statetable.c | 2 | ||||
-rw-r--r-- | net/wanrouter/wanmain.c | 2 |
8 files changed, 7 insertions, 19 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index ceef57c9ab32..de78c9dd713b 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c | |||
@@ -736,8 +736,7 @@ static int vlan_ioctl_handler(void __user *arg) | |||
736 | case SET_VLAN_NAME_TYPE_CMD: | 736 | case SET_VLAN_NAME_TYPE_CMD: |
737 | if (!capable(CAP_NET_ADMIN)) | 737 | if (!capable(CAP_NET_ADMIN)) |
738 | return -EPERM; | 738 | return -EPERM; |
739 | if ((args.u.name_type >= 0) && | 739 | if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) { |
740 | (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) { | ||
741 | vlan_name_type = args.u.name_type; | 740 | vlan_name_type = args.u.name_type; |
742 | err = 0; | 741 | err = 0; |
743 | } else { | 742 | } else { |
diff --git a/net/dccp/probe.c b/net/dccp/probe.c index 1f5e3ba62065..43a3adb027e7 100644 --- a/net/dccp/probe.c +++ b/net/dccp/probe.c | |||
@@ -128,7 +128,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf, | |||
128 | int error = 0, cnt = 0; | 128 | int error = 0, cnt = 0; |
129 | unsigned char *tbuf; | 129 | unsigned char *tbuf; |
130 | 130 | ||
131 | if (!buf || len < 0) | 131 | if (!buf) |
132 | return -EINVAL; | 132 | return -EINVAL; |
133 | 133 | ||
134 | if (len == 0) | 134 | if (len == 0) |
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c index 6d2a08205111..dc442fb791b0 100644 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | |||
@@ -177,8 +177,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum, | |||
177 | 177 | ||
178 | protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum, | 178 | protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum, |
179 | (*pskb)->len - extoff); | 179 | (*pskb)->len - extoff); |
180 | if (protoff < 0 || protoff > (*pskb)->len || | 180 | if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) { |
181 | pnum == NEXTHDR_FRAGMENT) { | ||
182 | DEBUGP("proto header not found\n"); | 181 | DEBUGP("proto header not found\n"); |
183 | return NF_ACCEPT; | 182 | return NF_ACCEPT; |
184 | } | 183 | } |
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c index 0be790d250f9..8814b95b2326 100644 --- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c +++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | |||
@@ -168,8 +168,7 @@ icmpv6_error_message(struct sk_buff *skb, | |||
168 | skb->len - inip6off | 168 | skb->len - inip6off |
169 | - sizeof(struct ipv6hdr)); | 169 | - sizeof(struct ipv6hdr)); |
170 | 170 | ||
171 | if ((inprotoff < 0) || (inprotoff > skb->len) || | 171 | if ((inprotoff > skb->len) || (inprotonum == NEXTHDR_FRAGMENT)) { |
172 | (inprotonum == NEXTHDR_FRAGMENT)) { | ||
173 | DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n"); | 172 | DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n"); |
174 | return -NF_ACCEPT; | 173 | return -NF_ACCEPT; |
175 | } | 174 | } |
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index 45b3cda86a21..6f8684b5617e 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c | |||
@@ -164,8 +164,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a, | |||
164 | printk("offset must be on 32 bit boundaries\n"); | 164 | printk("offset must be on 32 bit boundaries\n"); |
165 | goto bad; | 165 | goto bad; |
166 | } | 166 | } |
167 | if (skb->len < 0 || | 167 | if (offset > 0 && offset > skb->len) { |
168 | (offset > 0 && offset > skb->len)) { | ||
169 | printk("offset %d cant exceed pkt length %d\n", | 168 | printk("offset %d cant exceed pkt length %d\n", |
170 | offset, skb->len); | 169 | offset, skb->len); |
171 | goto bad; | 170 | goto bad; |
diff --git a/net/sctp/debug.c b/net/sctp/debug.c index e8c0f7435d7f..80f70aa53386 100644 --- a/net/sctp/debug.c +++ b/net/sctp/debug.c | |||
@@ -77,8 +77,6 @@ static const char *sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = { | |||
77 | /* Lookup "chunk type" debug name. */ | 77 | /* Lookup "chunk type" debug name. */ |
78 | const char *sctp_cname(const sctp_subtype_t cid) | 78 | const char *sctp_cname(const sctp_subtype_t cid) |
79 | { | 79 | { |
80 | if (cid.chunk < 0) | ||
81 | return "illegal chunk id"; | ||
82 | if (cid.chunk <= SCTP_CID_BASE_MAX) | 80 | if (cid.chunk <= SCTP_CID_BASE_MAX) |
83 | return sctp_cid_tbl[cid.chunk]; | 81 | return sctp_cid_tbl[cid.chunk]; |
84 | 82 | ||
@@ -146,8 +144,6 @@ static const char *sctp_primitive_tbl[SCTP_NUM_PRIMITIVE_TYPES] = { | |||
146 | /* Lookup primitive debug name. */ | 144 | /* Lookup primitive debug name. */ |
147 | const char *sctp_pname(const sctp_subtype_t id) | 145 | const char *sctp_pname(const sctp_subtype_t id) |
148 | { | 146 | { |
149 | if (id.primitive < 0) | ||
150 | return "illegal primitive"; | ||
151 | if (id.primitive <= SCTP_EVENT_PRIMITIVE_MAX) | 147 | if (id.primitive <= SCTP_EVENT_PRIMITIVE_MAX) |
152 | return sctp_primitive_tbl[id.primitive]; | 148 | return sctp_primitive_tbl[id.primitive]; |
153 | return "unknown_primitive"; | 149 | return "unknown_primitive"; |
@@ -161,8 +157,6 @@ static const char *sctp_other_tbl[] = { | |||
161 | /* Lookup "other" debug name. */ | 157 | /* Lookup "other" debug name. */ |
162 | const char *sctp_oname(const sctp_subtype_t id) | 158 | const char *sctp_oname(const sctp_subtype_t id) |
163 | { | 159 | { |
164 | if (id.other < 0) | ||
165 | return "illegal 'other' event"; | ||
166 | if (id.other <= SCTP_EVENT_OTHER_MAX) | 160 | if (id.other <= SCTP_EVENT_OTHER_MAX) |
167 | return sctp_other_tbl[id.other]; | 161 | return sctp_other_tbl[id.other]; |
168 | return "unknown 'other' event"; | 162 | return "unknown 'other' event"; |
@@ -184,8 +178,6 @@ static const char *sctp_timer_tbl[] = { | |||
184 | /* Lookup timer debug name. */ | 178 | /* Lookup timer debug name. */ |
185 | const char *sctp_tname(const sctp_subtype_t id) | 179 | const char *sctp_tname(const sctp_subtype_t id) |
186 | { | 180 | { |
187 | if (id.timeout < 0) | ||
188 | return "illegal 'timer' event"; | ||
189 | if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX) | 181 | if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX) |
190 | return sctp_timer_tbl[id.timeout]; | 182 | return sctp_timer_tbl[id.timeout]; |
191 | return "unknown_timer"; | 183 | return "unknown_timer"; |
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c index 523071c7902f..70a91ece3c49 100644 --- a/net/sctp/sm_statetable.c +++ b/net/sctp/sm_statetable.c | |||
@@ -960,7 +960,7 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid, | |||
960 | if (state > SCTP_STATE_MAX) | 960 | if (state > SCTP_STATE_MAX) |
961 | return &bug; | 961 | return &bug; |
962 | 962 | ||
963 | if (cid >= 0 && cid <= SCTP_CID_BASE_MAX) | 963 | if (cid <= SCTP_CID_BASE_MAX) |
964 | return &chunk_event_table[cid][state]; | 964 | return &chunk_event_table[cid][state]; |
965 | 965 | ||
966 | if (sctp_prsctp_enable) { | 966 | if (sctp_prsctp_enable) { |
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c index 7a19e0ede289..849cc06bd914 100644 --- a/net/wanrouter/wanmain.c +++ b/net/wanrouter/wanmain.c | |||
@@ -454,7 +454,7 @@ static int wanrouter_device_setup(struct wan_device *wandev, | |||
454 | } | 454 | } |
455 | 455 | ||
456 | if (conf->data_size && conf->data) { | 456 | if (conf->data_size && conf->data) { |
457 | if (conf->data_size > 128000 || conf->data_size < 0) { | 457 | if (conf->data_size > 128000) { |
458 | printk(KERN_INFO | 458 | printk(KERN_INFO |
459 | "%s: ERROR, Invalid firmware data size %i !\n", | 459 | "%s: ERROR, Invalid firmware data size %i !\n", |
460 | wandev->name, conf->data_size); | 460 | wandev->name, conf->data_size); |