Check the return value on memcpy_fromiovec().
net/irda/af_irda.c | 18 +++++++++++++++---
1 files changed, 15 insertions(+), 3 deletions(-)
===== net/irda/af_irda.c 1.49 vs edited =====
--- 1.49/net/irda/af_irda.c Fri Jan 9 02:10:53 2004
+++ edited/net/irda/af_irda.c Fri Jan 16 14:18:02 2004
@@ -1307,7 +1307,11 @@
skb_reserve(skb, self->max_header_size + 16);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
/*
* Just send the message to TinyTP, and let it deal with possible
@@ -1550,7 +1554,11 @@
IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
/*
* Just send the message to TinyTP, and let it deal with possible
@@ -1613,7 +1621,11 @@
IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
err = irlmp_connless_data_request(self->lsap, skb);
if (err) {
|