very odd check in caif_seqpkt_sendmsg()
From: Al Viro <viro@ZenIV.linux.org.uk>
Date: 2014-11-20 08:54:26
From: Al Viro <viro@ZenIV.linux.org.uk>
Date: 2014-11-20 08:54:26
This check is very odd:
if (unlikely(msg->msg_iov->iov_base == NULL))
goto err;
What happens if we get call it with msg_iovlen being 0? verify_iovec()
(or rw_copy_check_uvector(), for that matter) is just fine with that -
sendmsg() purely for msg_control is normal on e.g. AF_UNIX sockets.
And we end with ->msg_iov pointing to iovstack[], with iovstack[0] being
uninitialized. So at the very least your check is going to yield random
results in that case.
What is it supposed to check for? Note that memcpy_fromiovec() won't blow
up on NULL ->iov_base - with zero len it won't even look there and with
non-zero it'll fail with -EFAULT.
Was that intended to be if (unlikely(!len)) fail with EINVAL? Something
entirely different?