Check the return value on memcpy_fromiovec().
===== net/rose/af_rose.c 1.33 vs edited =====
--- 1.33/net/rose/af_rose.c Tue Sep 9 11:22:56 2003
+++ edited/net/rose/af_rose.c Mon Dec 8 16:58:33 2003
@@ -1079,7 +1079,11 @@
asmptr = skb->h.raw = skb_put(skb, len);
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (err) {
+ kfree_skb(skb);
+ return err;
+ }
/*
* If the Q BIT Include socket option is in force, the first