net: fix rds_iovec page count overflow

[karo-tx-linux.git] / net / rds / rdma.c

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 8dc83d2caa58d02d7036ea697a5fac65f470b564..f7d8c08bd6b2d97d5f74b9345c2a9054c8dc23a7 100644 (file)
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -447,7 +447,7 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                goto out;
        }
 
-       if (args->nr_local > (u64)UINT_MAX) {
+       if (args->nr_local > UIO_MAXIOV) {
                ret = -EMSGSIZE;
                goto out;
        }
@@ -473,6 +473,14 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
 
                max_pages = max(nr, max_pages);
                nr_pages += nr;
+
+               /*
+                * nr_pages for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
+                * so tot_pages cannot overflow without first going negative.
+                */
+               if ((int)nr_pages < 0)
+                       ret = -EINVAL;
+                       goto out;
        }
 
        pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);