libceph: account for alignment in pages cursor

[karo-tx-linux.git] / net / ceph / messenger.c

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 198b9026288e54d5a06c74978c2856c6b1c5af1b..ee160864e8eabcbcea9d1f32e14bc9de01f763d7 100644 (file)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -839,9 +839,10 @@ static void ceph_msg_data_pages_cursor_init(struct ceph_msg_data *data,
        page_count = calc_pages_for(data->alignment, (u64)data->length);
        cursor->page_offset = data->alignment & ~PAGE_MASK;
        cursor->page_index = 0;
-       BUG_ON(page_count > (int) USHRT_MAX);
-       cursor->page_count = (unsigned short) page_count;
-       cursor->last_piece = length <= PAGE_SIZE;
+       BUG_ON(page_count > (int)USHRT_MAX);
+       cursor->page_count = (unsigned short)page_count;
+       BUG_ON(length > SIZE_MAX - cursor->page_offset);
+       cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE;
 }
 
 static struct page *ceph_msg_data_pages_next(struct ceph_msg_data *data,