When sock_alloc_send_skb() returns NULL to skb, no error return code of
raw_sendmsg() is assigned.
To fix this bug, err is assigned with -ENOMEM in this case.
Fixes: 78f821b64826 ("ieee802154: socket: put handling into one file")
Reported-by: TOTE Robot <oslab@xxxxxxxxxxxxxxx>
Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
---
net/ieee802154/socket.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index a45a0401adc5..3d76b207385e 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -277,8 +277,10 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
tlen = dev->needed_tailroom;
skb = sock_alloc_send_skb(sk, hlen + tlen + size,
msg->msg_flags & MSG_DONTWAIT, &err);
- if (!skb)
+ if (!skb) {
+ err = -ENOMEM;
goto out_dev;
+ }
skb_reserve(skb, hlen);
--
2.17.1
