|
@@ -467,10 +467,10 @@ static ssize_t do_readv_writev(int type, struct file *file,
|
|
|
void __user *buf = iov[seg].iov_base;
|
|
|
ssize_t len = (ssize_t)iov[seg].iov_len;
|
|
|
|
|
|
- if (unlikely(!access_ok(vrfy_dir(type), buf, len)))
|
|
|
- goto Efault;
|
|
|
if (len < 0) /* size_t not fitting an ssize_t .. */
|
|
|
goto out;
|
|
|
+ if (unlikely(!access_ok(vrfy_dir(type), buf, len)))
|
|
|
+ goto Efault;
|
|
|
tot_len += len;
|
|
|
if ((ssize_t)tot_len < 0) /* maths overflow on the ssize_t */
|
|
|
goto out;
|