[PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[Jean Tourrilhes]

Chris Wright wrote :
> Check the return value on memcpy_fromiovec().
> 
>  net/irda/af_irda.c |   18 +++++++++++++++---
>  1 files changed, 15 insertions(+), 3 deletions(-)

	Oups, I must have missed the first edition. I've added this is
my patch queue in case Dave doesn't pick it up, but as you can see I
now have a bit of backlog :
	http://www.hpl.hp.com/personal/Jean_Tourrilhes/IrDA/IrDA.html

	Have fun...

	Jean

Re: [PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[Chris Wright]

* Jean Tourrilhes (jt@bougret.hpl.hp.com) wrote:
> 	Oups, I must have missed the first edition. I've added this is
> my patch queue in case Dave doesn't pick it up, but as you can see I

thanks.

-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

Re: [PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[David S. Miller]

On Fri, 16 Jan 2004 17:40:05 -0800
Jean Tourrilhes <jt@bougret.hpl.hp.com> wrote:

> 	Oups, I must have missed the first edition. I've added this is
> my patch queue in case Dave doesn't pick it up, but as you can see I
> now have a bit of backlog :
> 	http://www.hpl.hp.com/personal/Jean_Tourrilhes/IrDA/IrDA.html

Don't sweat it, I just sucked it into my tree.

[PATCH 1/4] ax25 check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/ax25/af_ax25.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletion(-)

===== net/ax25/af_ax25.c 1.36 vs edited =====
--- 1.36/net/ax25/af_ax25.c	Fri Jan  9 01:53:04 2004
+++ edited/net/ax25/af_ax25.c	Fri Jan 16 14:13:54 2004
@@ -1526,7 +1526,12 @@
 	SOCK_DEBUG(sk, "AX.25: Appending user data\n");
 
 	/* User data follows immediately after the AX.25 data */
-	memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
+		err = -EFAULT;
+		kfree_skb(skb);
+		goto out;
+	}
+
 	skb->nh.raw = skb->data;
 
 	/* Add the PID if one is not supplied by the user in the skb */

[PATCH 2/4] irda check error on memcpy_fromiovec (resend)

[Chris Wright]

Check the return value on memcpy_fromiovec().

 net/irda/af_irda.c |   18 +++++++++++++++---
 1 files changed, 15 insertions(+), 3 deletions(-)

===== net/irda/af_irda.c 1.49 vs edited =====
--- 1.49/net/irda/af_irda.c	Fri Jan  9 02:10:53 2004
+++ edited/net/irda/af_irda.c	Fri Jan 16 14:18:02 2004
@@ -1307,7 +1307,11 @@
 	skb_reserve(skb, self->max_header_size + 16);
 
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	/*
 	 * Just send the message to TinyTP, and let it deal with possible
@@ -1550,7 +1554,11 @@
 
 	IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	/*
 	 * Just send the message to TinyTP, and let it deal with possible
@@ -1613,7 +1621,11 @@
 
 	IRDA_DEBUG(4, "%s(), appending user data\n", __FUNCTION__);
 	asmptr = skb->h.raw = skb_put(skb, len);
-	memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	err = memcpy_fromiovec(asmptr, msg->msg_iov, len);
+	if (err) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	err = irlmp_connless_data_request(self->lsap, skb);
 	if (err) {