Merge with Linux 2.2.8.

1 files changed, 8 insertions, 1 deletions

diff --git a/net/core/iovec.c b/net/core/iovec.c
index 8919fc5c1..c20f85303 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -59,8 +59,15 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, char *address, int mode)
 		goto out;
 	m->msg_iov=iov;
 
-	for (err = 0, ct = 0; ct < m->msg_iovlen; ct++)
+	for (err = 0, ct = 0; ct < m->msg_iovlen; ct++) {
 		err += iov[ct].iov_len;
+		/* Goal is not to verify user data, but to prevent returning
+		   negative value, which is interpreted as errno.
+		   Overflow is still possible, but it is harmless.
+		 */
+		if (err < 0)
+			return -EMSGSIZE;
+	}
 out:
 	return err;
 }