syscall: msg: validate iovec array itself as well as the buffers it points to

syscall/msg.c

@@ -165,6 +165,10 @@ static bool validate_iovec(
 	size_t count,
 	bool rw)
 {
+	if (!validate_access_r(task, iov, count * sizeof(struct iovec))) {
+		return false;
+	}
+
 	for (size_t i = 0; i < count; i++) {
 		bool ok = false;
 		const struct iovec *vec = &iov[i];