On Wed, 2016-01-27 at 11:50 -0800, Cong Wang wrote: > Hmm? I think nfc_llcp_send_ui_frame() needs to do some fragmention > with this temporary memory, or you are saying msg_iter has some > API available to seek the pointer? Even if so, it doesn't look like > suitable for -stable. >
memcpy_from_msg(msg_data, msg, len) will overwrite the msg_data with len bytes, or return an error. So prior msg_data content does not matter. kzalloc() before a memset() or memcpy() sounds defensive programming, kmalloc() is a bit faster.
