skb->len is always non-negative. The problem has been detected using proposed semantic patch scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1]. [1]: http://permalink.gmane.org/gmane.linux.kernel/2038576
Unified · Split
| @@ -2424,11 +2424,6 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb) · 2423 unmodified lines | ||
| 2424 | 2424 | skb_pull(skb, align_count); |
| 2425 | 2425 | } |
| 2426 | 2426 | |
| 2427 | − if (unlikely(skb->len < 0)) { | |
| 2428 | − netdev_warn(dev->net, "invalid rx length<0 %d", skb->len); | |
| 2429 | − return 0; | |
| 2430 | − } | |
| 2431 | − | |
| 2432 | 2427 | return 1; |
| 2433 | 2428 | } |
| 2434 | 2429 | |
| @@ -2185,11 +2185,6 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) · 2184 unmodified lines | ||
| 2185 | 2185 | skb_pull(skb, align_count); |
| 2186 | 2186 | } |
| 2187 | 2187 | |
| 2188 | − if (unlikely(skb->len < 0)) { | |
| 2189 | − netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len); | |
| 2190 | − return 0; | |
| 2191 | − } | |
| 2192 | − | |
| 2193 | 2188 | return 1; |
| 2194 | 2189 | } |
| 2195 | 2190 | |
| @@ -1815,11 +1815,6 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) · 1814 unmodified lines | ||
| 1815 | 1815 | skb_pull(skb, align_count); |
| 1816 | 1816 | } |
| 1817 | 1817 | |
| 1818 | − if (unlikely(skb->len < 0)) { | |
| 1819 | − netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len); | |
| 1820 | − return 0; | |
| 1821 | − } | |
| 1822 | − | |
| 1823 | 1818 | return 1; |
| 1824 | 1819 | } |
| 1825 | 1820 | |