Check the return value on memcpy_fromiovec().
net/netrom/af_netrom.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletion(-)
===== net/netrom/af_netrom.c 1.43 vs edited =====
--- 1.43/net/netrom/af_netrom.c Fri Jan 9 01:56:08 2004
+++ edited/net/netrom/af_netrom.c Fri Jan 16 14:17:01 2004
@@ -1101,7 +1101,12 @@
SOCK_DEBUG(sk, "NET/ROM: Appending user data\n");
/* User data follows immediately after the NET/ROM transport header */
- memcpy_fromiovec(asmptr, msg->msg_iov, len);
+ if (memcpy_fromiovec(asmptr, msg->msg_iov, len)) {
+ kfree_skb(skb);
+ err = -EFAULT;
+ goto out;
+ }
+
SOCK_DEBUG(sk, "NET/ROM: Transmitting buffer\n");
if (sk->sk_state != TCP_ESTABLISHED) {