In `j1939_sk_setsockopt_flag()`, after copying the integer option value
`tmp` from userspace and updating `jsk->state`, the function returns
`tmp` instead of `0`.

If a caller passes a negative integer (e.g., `-1`) to enable
`SO_J1939_BROADCAST` or `SO_J1939_PROMISC`, `if (tmp)` sets `jsk->state
|= flag` and then returns the negative value as an error code from
`setsockopt()`. If a caller passes a positive non-zero integer (e.g.,
`1`), `setsockopt()` violates POSIX by returning `1` instead of `0`.

Return `0` on success in `j1939_sk_setsockopt_flag()`.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/can/j1939/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 50a598ef5fd4..1d4af472de4a 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -688,7 +688,7 @@ static int j1939_sk_setsockopt_flag(struct j1939_sock *jsk, sockptr_t optval,
 	else
 		jsk->state &= ~flag;
 	release_sock(&jsk->sk);
-	return tmp;
+	return 0;
 }
 
 static int j1939_sk_setsockopt(struct socket *sock, int level, int optname,
-- 
2.55.0.1082.g2b9226bbc0-goog

On Sat, Sep 19, 2026 at 09:36:32PM +0000, Hui Peng wrote:
> In `j1939_sk_setsockopt_flag()`, after copying the integer option value
> `tmp` from userspace and updating `jsk->state`, the function returns
> `tmp` instead of `0`.
> 
> If a caller passes a negative integer (e.g., `-1`) to enable
> `SO_J1939_BROADCAST` or `SO_J1939_PROMISC`, `if (tmp)` sets `jsk->state
> |= flag` and then returns the negative value as an error code from
> `setsockopt()`. If a caller passes a positive non-zero integer (e.g.,
> `1`), `setsockopt()` violates POSIX by returning `1` instead of `0`.
> 
> Return `0` on success in `j1939_sk_setsockopt_flag()`.
> 
> Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

I agree that the problem described exists, and that your patch addresses        it. That the but was introduced in the cited commit. And that the corrected
behaviour matches that described in Documentation/networking/j1939.rst
for SO_J1939_ERRQUEUE and SO_J1939_PROMISC, the two users of
j1939_sk_setsockopt_flag().

   "The acceptable value size for this option is ``sizeof(int)``, and the
    value is only differentiated between `0` and non-zero."

Reviewed-by: Simon Horman <horms@kernel.org>