kernels/linux-2.4.0/net/core/iovec.c
/*
 *	Verify iovec. The caller must ensure that the iovec is big enough
 *	to hold the message iovec.
 *
 *	Save time not doing verify_area. copy_*_user will make this work
 *	in any case.
 */
Verify iovec. The caller must ensure that the iovec is big enough
to hold the message iovec.

Save time not doing verify_area. copy_*_user will make this work
in any case.
Verify iovec . The caller must ensure that the iovec is big enough to hold the message iovec . Save time not doing verify_area . copy_ * _user will make this work in any case .
int verify_iovec(struct msghdr *m, struct iovec *iov, char *address, int mode)
{
	int size, err, ct;
	if(m->msg_namelen)
	{
		if(mode==VERIFY_READ)
		{
			err=move_addr_to_kernel(m->msg_name, m->msg_namelen, address);
			if(err<0)
				goto out;
		}
		m->msg_name = address;
	} else
		m->msg_name = NULL;
	err = -EFAULT;
	size = m->msg_iovlen * sizeof(struct iovec);
	if (copy_from_user(iov, m->msg_iov, size))
		goto out;
	m->msg_iov=iov;
	for (err = 0, ct = 0; ct < m->msg_iovlen; ct++) {
		err += iov[ct].iov_len;
		if (err < 0)
			return -EMSGSIZE;
	}
out:
	return err;
}
int verify_iovec ( struct msghdr * m , struct iovec * iov , char * address , int mode ) { int size , err , ct ; if ( m -> msg_namelen ) { if ( mode == VERIFY_READ ) { err = move_addr_to_kernel ( m -> msg_name , m -> msg_namelen , address ) ; if ( err < 0 ) goto out ; } m -> msg_name = address ; } else m -> msg_name = NULL ; err = - EFAULT ; size = m -> msg_iovlen * sizeof ( struct iovec ) ; if ( copy_from_user ( iov , m -> msg_iov , size ) ) goto out ; m -> msg_iov = iov ; for ( err = 0 , ct = 0 ; ct < m -> msg_iovlen ; ct ++ ) { err += iov [ ct ] . iov_len ; if ( err < 0 ) return - EMSGSIZE ; } out : return err ; }
Verify iovec.
Verify iovec .
/* Goal is not to verify user data, but to prevent returning
		   negative value, which is interpreted as errno.
		   Overflow is still possible, but it is harmless.
		 */