Check the return value on memcpy_fromiovec().
===== net/irda/af_irda.c 1.47 vs edited =====
--- 1.47/net/irda/af_irda.c Tue Nov 4 16:29:43 2003
+++ edited/net/irda/af_irda.c Fri Dec 5 17:29:04 2003
@@ -1307,7 +1307,11 @@
skb_reserve(skb, self->max_header_size + 16);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
/*
* Just send the message to TinyTP, and let it deal with possible
@@ -1549,7 +1553,11 @@
IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
/*
* Just send the message to TinyTP, and let it deal with possible
@@ -1612,7 +1620,11 @@
IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
err = irlmp_connless_data_request(self->lsap, skb);
if (err) {
|