func: static int CVE_2011_1173_PATCHED_econet_sendmsg(struct kiocb *iocb, struct socket struct msghdr *msg, size_t len) struct sock * sk = sock -> sk ; struct sockaddr_ec * saddr = ( struct sockaddr_ec * ) msg -> msg_name ; struct net_device * dev ; struct ec_addr addr ; struct aunhdr ah ; if ( msg -> msg_flags & ~ ( MSG_DONTWAIT | MSG_CMSG_COMPAT ) )  if ( saddr == NULL )  struct econet_sock * eo = ec_sk ( sk ) ; addr . station = eo -> station; addr . net = eo -> net; if ( msg -> msg_namelen < sizeof ( struct sockaddr_ec ) )  addr . station = saddr -> addr . station; addr . net = saddr -> addr . net; dev = net2dev_map [ addr . net ]; if ( dev == NULL )  dev = net2dev_map [ 0 ]; if ( dev == NULL )  if ( len + 15 > dev -> mtu )  if ( dev -> type == ARPHRD_ECONET )  if ( udpsock == NULL )  memset ( & ah , 0 , sizeof ( ah ) ); ah . port = port; ah . cb = cb & 0x7f; ah . code = 2; iov [ 0 ] . iov_base = ( void * ) & ah; iov [ 0 ] . iov_len = size; void __user * base = msg -> msg_iov [ i ] . iov_base ; size_t iov_len = msg -> msg_iov [ i ] . iov_len ; if ( ! access_ok ( VERIFY_READ , base , iov_len ) )  iov [ i + 1 ] . iov_base = base; iov [ i + 1 ] . iov_len = iov_len; size += iov_len; ah . handle = aun_seq; udpmsg . msg_iov = & iov [ 0 ]; udpmsg . msg_iovlen = msg -> msg_iovlen + 1; udpmsg . msg_control = NULL; udpmsg . msg_controllen = 0; udpmsg . msg_flags = 0; err = sock_sendmsg ( udpsock , & udpmsg , size ); return err ; 