Commit 907b978e82cb for kernel

commit 907b978e82cb4c1c245fc2985bb27c5d5c88c8f6
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Sep 24 08:29:50 2026 +0000

    net/sched: sch_teql: fix shadowed err in __teql_resolve()

    __teql_resolve() declares an inner 'int err;' inside the
    'if (neigh_event_send(n, skb_res) == 0)' block, shadowing the outer
    'int err = 0;'. As a result, a negative return from dev_hard_header()
    is written to the inner variable and __teql_resolve() still returns 0.

    Remove the shadowed variable and set the outer err to -EINVAL when
    dev_hard_header() returns a negative error.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Closes: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260924082951.1599377-4-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 9e52afc2d980..409ce50cc0db 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -265,14 +265,11 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
 	}

 	if (neigh_event_send(n, skb_res) == 0) {
-		int err;
 		char haddr[MAX_ADDR_LEN];

 		neigh_ha_snapshot(haddr, n, dev);
-		err = dev_hard_header(skb, dev, ntohs(skb_protocol(skb, false)),
-				      haddr, NULL, skb->len);
-
-		if (err < 0)
+		if (dev_hard_header(skb, dev, ntohs(skb_protocol(skb, false)),
+				    haddr, NULL, skb->len) < 0)
 			err = -EINVAL;
 	} else {
 		err = (skb_res == NULL) ? -EAGAIN : 1;