diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-30 18:42:58 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-30 18:42:58 -0700 |
| commit | 3985c7ce85039adacdf882904ca096f091d39346 (patch) | |
| tree | afaf4161c4c3d9516cc09295eb30c0e22a8c3008 /net/rds/message.c | |
| parent | fcf744a96c66ca6ad7301a372034b771e57f30c4 (diff) | |
| parent | ce384d91cd7a4269a1ed5d4307a70aa4c6fa14f2 (diff) | |
| download | linux-3.10-3985c7ce85039adacdf882904ca096f091d39346.tar.gz linux-3.10-3985c7ce85039adacdf882904ca096f091d39346.tar.bz2 linux-3.10-3985c7ce85039adacdf882904ca096f091d39346.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
isdn: mISDN: socket: fix information leak to userland
netdev: can: Change mail address of Hans J. Koch
pcnet_cs: add new_id
net: Truncate recvfrom and sendto length to INT_MAX.
RDS: Let rds_message_alloc_sgs() return NULL
RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace
RDS: Clean up error handling in rds_cmsg_rdma_args
RDS: Return -EINVAL if rds_rdma_pages returns an error
net: fix rds_iovec page count overflow
can: pch_can: fix section mismatch warning by using a whitelisted name
can: pch_can: fix sparse warning
netxen_nic: Fix the tx queue manipulation bug in netxen_nic_probe
ip_gre: fix fallback tunnel setup
vmxnet: trivial annotation of protocol constant
vmxnet3: remove unnecessary byteswapping in BAR writing macros
ipv6/udp: report SndbufErrors and RcvbufErrors
phy/marvell: rename 88ec048 to 88e1318s and fix mscr1 addr
Diffstat (limited to 'net/rds/message.c')
| -rw-r--r-- | net/rds/message.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/rds/message.c b/net/rds/message.c index a84545dae37..848cff45183 100644 --- a/net/rds/message.c +++ b/net/rds/message.c @@ -224,6 +224,9 @@ struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents) WARN_ON(rm->m_used_sgs + nents > rm->m_total_sgs); WARN_ON(!nents); + if (rm->m_used_sgs + nents > rm->m_total_sgs) + return NULL; + sg_ret = &sg_first[rm->m_used_sgs]; sg_init_table(sg_ret, nents); rm->m_used_sgs += nents; @@ -246,6 +249,8 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len); rm->data.op_nents = ceil(total_len, PAGE_SIZE); rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs); + if (!rm->data.op_sg) + return ERR_PTR(-ENOMEM); for (i = 0; i < rm->data.op_nents; ++i) { sg_set_page(&rm->data.op_sg[i], |