skb->len is always non-negative. The problem has been detected using proposed semantic patch scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1]. [1]: http://permalink.gmane.org/gmane.linux.kernel/2038576
Unified · Split
| @@ -2424,11 +2424,6 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb) · 2423 unmodified lines | |||
| 2424 | skb_pull(skb, align_count); | 2424 | skb_pull(skb, align_count); |
| 2425 | } | 2425 | } |
| 2426 | 2426 | ||
| 2427 | if (unlikely(skb->len < 0)) { | ||
| 2428 | netdev_warn(dev->net, "invalid rx length<0 %d", skb->len); | ||
| 2429 | return 0; | ||
| 2430 | } | ||
| 2431 | |||
| 2432 | return 1; | 2427 | return 1; |
| 2433 | } | 2428 | } |
| 2434 | 2429 | ||
| @@ -2185,11 +2185,6 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) · 2184 unmodified lines | |||
| 2185 | skb_pull(skb, align_count); | 2185 | skb_pull(skb, align_count); |
| 2186 | } | 2186 | } |
| 2187 | 2187 | ||
| 2188 | if (unlikely(skb->len < 0)) { | ||
| 2189 | netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len); | ||
| 2190 | return 0; | ||
| 2191 | } | ||
| 2192 | |||
| 2193 | return 1; | 2188 | return 1; |
| 2194 | } | 2189 | } |
| 2195 | 2190 | ||
| @@ -1815,11 +1815,6 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) · 1814 unmodified lines | |||
| 1815 | skb_pull(skb, align_count); | 1815 | skb_pull(skb, align_count); |
| 1816 | } | 1816 | } |
| 1817 | 1817 | ||
| 1818 | if (unlikely(skb->len < 0)) { | ||
| 1819 | netdev_warn(dev->net, "invalid rx length<0 %d\n", skb->len); | ||
| 1820 | return 0; | ||
| 1821 | } | ||
| 1822 | |||
| 1823 | return 1; | 1818 | return 1; |
| 1824 | } | 1819 | } |
| 1825 | 1820 | ||