if (len < 0 || len > 0xFFFF) 
if (len > 0xFFFF) 
static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,		       size_t len){	struct inet_sock *inet = inet_sk(sk);	struct ipcm_cookie ipc;	struct rtable *rt = NULL;	int free = 0;	u32 daddr;	u32 saddr;	u8  tos;	int err;	err = -EMSGSIZE;	if (len < 0 || len > 0xFFFF)		goto out;	/*	 *	Check the flags.	 */	err = -EOPNOTSUPP;	if (msg->msg_flags & MSG_OOB)	/* Mirror BSD error message */		goto out;               /* compatibility */			 	/*	 *	Get and verify the address. 	 */	if (msg->msg_namelen) {		struct sockaddr_in *usin = (struct sockaddr_in*)msg->msg_name;		err = -EINVAL;		if (msg->msg_namelen < sizeof(*usin))			goto out;		if (usin->sin_family != AF_INET) {			static int complained;			if (!complained++)				printk(KERN_INFO "%s forgot to set AF_INET in "						 "raw sendmsg. Fix it!\n",						 current->comm);			err = -EAFNOSUPPORT;			if (usin->sin_family)				goto out;		}		daddr = usin->sin_addr.s_addr;		/* ANK: I did not forget to get protocol from port field.		 * I just do not know, who uses this weirdness.		 * IP_HDRINCL is much more convenient.		 */	} else {		err = -EDESTADDRREQ;		if (sk->sk_state != TCP_ESTABLISHED) 			goto out;		daddr = inet->daddr;	}	ipc.addr = inet->saddr;	ipc.opt = NULL;	ipc.oif = sk->sk_bound_dev_if;	if (msg->msg_controllen) {		err = ip_cmsg_send(msg, &ipc);		if (err)			goto out;		if (ipc.opt)			free = 1;	}	saddr = ipc.addr;	ipc.addr = daddr;	if (!ipc.opt)		ipc.opt = inet->opt;	if (ipc.opt) {		err = -EINVAL;		/* Linux does not mangle headers on raw sockets,		 * so that IP options + IP_HDRINCL is non-sense.		 */		if (inet->hdrincl)			goto done;		if (ipc.opt->srr) {			if (!daddr)				goto done;			daddr = ipc.opt->faddr;		}	}	tos = RT_CONN_FLAGS(sk);	if (msg->msg_flags & MSG_DONTROUTE)		tos |= RTO_ONLINK;	if (MULTICAST(daddr)) {		if (!ipc.oif)			ipc.oif = inet->mc_index;		if (!saddr)			saddr = inet->mc_addr;	}	{		struct flowi fl = { .oif = ipc.oif,				    .nl_u = { .ip4_u =					      { .daddr = daddr,						.saddr = saddr,						.tos = tos } },				    .proto = inet->hdrincl ? IPPROTO_RAW :					    		     sk->sk_protocol,				  };		if (!inet->hdrincl)			raw_probe_proto_opt(&fl, msg);		err = ip_route_output_flow(&rt, &fl, sk, !(msg->msg_flags&MSG_DONTWAIT));	}	if (err)		goto done;	err = -EACCES;	if (rt->rt_flags & RTCF_BROADCAST && !sock_flag(sk, SOCK_BROADCAST))		goto done;	if (msg->msg_flags & MSG_CONFIRM)		goto do_confirm;back_from_confirm:	if (inet->hdrincl)		err = raw_send_hdrinc(sk, msg->msg_iov, len, 					rt, msg->msg_flags);		 else {		if (!ipc.addr)			ipc.addr = rt->rt_dst;		lock_sock(sk);		err = ip_append_data(sk, ip_generic_getfrag, msg->msg_iov, len, 0,					&ipc, rt, msg->msg_flags);		if (err)			ip_flush_pending_frames(sk);		else if (!(msg->msg_flags & MSG_MORE))			err = ip_push_pending_frames(sk);		release_sock(sk);	}done:	if (free)		kfree(ipc.opt);	ip_rt_put(rt);out:	if (err < 0)		return err;	return len;do_confirm:	dst_confirm(&rt->u.dst);	if (!(msg->msg_flags & MSG_PROBE) || len)		goto back_from_confirm;	err = 0;	goto done;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/926d4b8122fb324de294a09a7d96d8af7cfc6861/raw.c/buggy/net/ipv4/raw.c