In `j1939_sk_setsockopt_flag()`, after copying the integer option value `tmp` from userspace and updating `jsk->state`, the function returns `tmp` instead of `0`. If a caller passes a negative integer (e.g., `-1`) to enable `SO_J1939_BROADCAST` or `SO_J1939_PROMISC`, `if (tmp)` sets `jsk->state |= flag` and then returns the negative value as an error code from `setsockopt()`. If a caller passes a positive non-zero integer (e.g., `1`), `setsockopt()` violates POSIX by returning `1` instead of `0`. Return `0` on success in `j1939_sk_setsockopt_flag()`. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Assisted-by: LLM Signed-off-by: Hui Peng --- net/can/j1939/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index 50a598ef5fd4..1d4af472de4a 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -688,7 +688,7 @@ static int j1939_sk_setsockopt_flag(struct j1939_sock *jsk, sockptr_t optval, else jsk->state &= ~flag; release_sock(&jsk->sk); - return tmp; + return 0; } static int j1939_sk_setsockopt(struct socket *sock, int level, int optname, -- 2.55.0.1082.g2b9226bbc0-goog