Subject: [PATCH] cipso: subtraction on unsigned hdr_delta

From: Roel Kluin <[email-masked]>
Date: Tue, 03 Mar 2009 23:23:38 +0100

hdr_delta is unsigned, so take care not to subtract below 0.

Signed-off-by: Roel Kluin <[email-masked]>
---
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 7bc9929..b1d862b 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1999,7 +1999,11 @@ void cipso_v4_sock_delattr(struct sock *sk)
 				iter++;
 		hdr_delta = opt->optlen;
 		opt->optlen = (optlen_new + 3) & ~3;
-		hdr_delta -= opt->optlen;
+
+		if (hdr_delta > opt->optlen)
+			hdr_delta -= opt->optlen;
+		else
+			hdr_delta = 0;
 	} else {
 		/* only the cipso option was present on the socket so we can
 		 * remove the entire option struct */