From ef1bc119ceb52d22a83f72b8dfce1dd64a3cca05 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 26 May 2023 16:39:15 +0300 Subject: [PATCH] net: fix signedness bug in skb_splice_from_iter() The "len" variable needs to be signed for the error handling to work correctly. Fixes: 2e910b95329c ("net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES") Signed-off-by: Dan Carpenter Reviewed-by: David Howells Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/366861a7-87c8-4bbf-9101-69dd41021d07@kili.mountain Signed-off-by: Jakub Kicinski --- net/core/skbuff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 653abd8a69752..7c4338221b173 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6931,8 +6931,8 @@ ssize_t skb_splice_from_iter(struct sk_buff *skb, struct iov_iter *iter, unsigned int i; while (iter->count > 0) { - ssize_t space, nr; - size_t off, len; + ssize_t space, nr, len; + size_t off; ret = -EMSGSIZE; space = frag_limit - skb_shinfo(skb)->nr_frags; -- 2.30.2