diff options
| author | Paul Lawrence <paullawrence@google.com> | 2017-10-18 09:20:15 -0700 |
|---|---|---|
| committer | SecurityBot <android-nexus-securitybot@system.gserviceaccount.com> | 2017-11-30 12:10:43 -0800 |
| commit | b62896b1c4c3d83dab5f9d3d537810dc2d77fc1d (patch) | |
| tree | 322d499278346c13aebe42b3699f140682b6d46f | |
| parent | 4b55b71501d5c42c397389d957f5b622f60d63ad (diff) | |
| download | tegra-b62896b1c4c3d83dab5f9d3d537810dc2d77fc1d.tar.gz | |
iovec: make sure the caller actually wants anything in memcpy_fromiovecend
Based on upstream change 06ebb06d49486676272a3c030bfeef4bd969a8e6
One more instance when the caller requests 0 bytes instead of running
off and dereferencing potentially invalid iovecs.
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Bug: 36279469
Change-Id: Ib8d529e17c07c77357ab70bd6a2d7e305d6b27f0
| -rw-r--r-- | net/core/iovec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/core/iovec.c b/net/core/iovec.c index e1ec45ab1e63..4c3fd5845f4b 100644 --- a/net/core/iovec.c +++ b/net/core/iovec.c @@ -88,6 +88,10 @@ int csum_partial_copy_fromiovecend(unsigned char *kdata, struct iovec *iov, __wsum csum = *csump; int partial_cnt = 0, err = 0; + /* No data? Done! */ + if (len == 0) + return 0; + /* Skip over the finished iovecs */ while (offset >= iov->iov_len) { offset -= iov->iov_len; |