[PATCH 1/4] ax25 check error on memcpy_fromiovec (resend)

[PATCH 1/4] ax25 check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/ax25/af_ax25.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletion(-)

===== net/ax25/af_ax25.c 1.36 vs edited =====
--- 1.36/net/ax25/af_ax25.c	Fri Jan  9 01:53:04 2004
+++ edited/net/ax25/af_ax25.c	Fri Jan 16 14:13:54 2004
@@ -1526,7 +1526,12 @@
 	SOCK_DEBUG(sk, "AX.25: Appending user data\n");
 
 	/* User data follows immediately after the AX.25 data */
-	memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
+		err = -EFAULT;
+		kfree_skb(skb);
+		goto out;
+	}
+
 	skb->nh.raw = skb->data;
 
 	/* Add the PID if one is not supplied by the user in the skb */

[PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/irda/af_irda.c |   18 +++++++++++++++---
 1 files changed, 15 insertions(+), 3 deletions(-)

===== net/irda/af_irda.c 1.49 vs edited =====
--- 1.49/net/irda/af_irda.c	Fri Jan  9 02:10:53 2004
+++ edited/net/irda/af_irda.c	Fri Jan 16 14:18:02 2004
@@ -1307,7 +1307,11 @@
 	skb_reserve(skb, self->max_header_size + 16);
 
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	/*
 	 * Just send the message to TinyTP, and let it deal with possible
@@ -1550,7 +1554,11 @@
 
 	IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	/*
 	 * Just send the message to TinyTP, and let it deal with possible
@@ -1613,7 +1621,11 @@
 
 	IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	err = irlmp_connless_data_request(self->lsap, skb);
 	if (err) {

[PATCH 3/4] netrom check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/netrom/af_netrom.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletion(-)

===== net/netrom/af_netrom.c 1.43 vs edited =====
--- 1.43/net/netrom/af_netrom.c	Fri Jan  9 01:56:08 2004
+++ edited/net/netrom/af_netrom.c	Fri Jan 16 14:17:01 2004
@@ -1101,7 +1101,12 @@
 	SOCK_DEBUG(sk, "NET/ROM: Appending user data\n");
 
 	/* User data follows immediately after the NET/ROM transport header */
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (memcpy_fromiovec(asmptr, msg->msg_iov, len)) {
+		kfree_skb(skb);
+		err = -EFAULT;
+		goto out;
+	}
+
 	SOCK_DEBUG(sk, "NET/ROM: Transmitting buffer\n");
 
 	if (sk->sk_state != TCP_ESTABLISHED) {

[PATCH 4/4] rose check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/rose/af_rose.c |   12 +++++++++---
 1 files changed, 9 insertions(+), 3 deletions(-)

===== net/rose/af_rose.c 1.37 vs edited =====
--- 1.37/net/rose/af_rose.c	Fri Jan  9 01:56:39 2004
+++ edited/net/rose/af_rose.c	Fri Jan 16 14:15:17 2004
@@ -1083,7 +1083,11 @@
 
 	asmptr = skb->h.raw = skb_put(skb, len);
 
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	/*
 	 *	If the Q BIT Include socket option is in force, the first
@@ -1133,8 +1137,10 @@
 		frontlen = skb_headroom(skb);
 
 		while (skb->len > 0) {
-			if ((skbn = sock_alloc_send_skb(sk, frontlen + ROSE_PACLEN, 0, &err)) == NULL)
+			if ((skbn = sock_alloc_send_skb(sk, frontlen + ROSE_PACLEN, 0, &err)) == NULL) {
+				kfree_skb(skb);
 				return err;
+			}
 
 			skbn->sk   = sk;
 			skbn->free = 1;
@@ -1159,7 +1165,7 @@
 		}
 
 		skb->free = 1;
-		kfree_skb(skb, FREE_WRITE);
+		kfree_skb(skb);
 	} else {
 		skb_queue_tail(&sk->sk_write_queue, skb);		/* Throw it on the queue */
 	}

Re: [PATCH 4/4] rose check error on memcpy_fromiovec (resend)

[David S. Miller]

On Fri, 16 Jan 2004 14:28:21 -0800
Chris Wright <chrisw@osdl.org> wrote:

> Check the return value on memcpy_fromiovec().

All 4 patches applied, thanks a lot Chris.