diff options
| author | Nicolas Kaiser <nikai@nikai.net> | 2011-03-04 14:49:41 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-03-08 00:57:58 +0100 |
| commit | ce3c869283739379134e1a90c37dd1a30b5f31b7 (patch) | |
| tree | 781b387b2bf46d494084a080334c7eb4084fbacf | |
| parent | net: fix multithreaded signal handling in unix recv routines (diff) | |
| download | linux-ce3c869283739379134e1a90c37dd1a30b5f31b7.tar.xz linux-ce3c869283739379134e1a90c37dd1a30b5f31b7.zip | |
drivers/net/macvtap: fix error check
'len' is unsigned of type size_t and can't be negative.
Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/macvtap.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c index 5933621ac3ff..fc27a9926d9e 100644 --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -528,8 +528,9 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, vnet_hdr_len = q->vnet_hdr_sz; err = -EINVAL; - if ((len -= vnet_hdr_len) < 0) + if (len < vnet_hdr_len) goto err; + len -= vnet_hdr_len; err = memcpy_fromiovecend((void *)&vnet_hdr, iv, 0, sizeof(vnet_hdr)); |