Commit 06ebb06d authored Jul 31, 2014 by Sasha Levin Committed by David S. Miller Aug 02, 2014

iovec: make sure the caller actually wants anything in memcpy_fromiovecend



Check for cases when the caller requests 0 bytes instead of running off
and dereferencing potentially invalid iovecs.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent fcdfe3a7

lib/iovec.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -85,6 +85,10 @@ EXPORT_SYMBOL(memcpy_toiovecend);
		int memcpy_fromiovecend(unsigned char kdata, const struct iovec iov,
		int offset, int len)
		{
		/* No data? Done! */
		if (len == 0)
		return 0;

		/* Skip over the finished iovecs */
		while (offset >= iov->iov_len) {
		offset -= iov->iov_len;