rds: limit the size allocated by rds_message_alloc()

[karo-tx-linux.git] / net / rds / message.c

diff --git a/net/rds/message.c b/net/rds/message.c
index f0a4658f3273e2e87bac1ae88058e1209ed3332a..aff589cc022e664962ac1570cbf410be7482b197 100644 (file)
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -197,6 +197,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
        struct rds_message *rm;
 
+       if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+               return NULL;
+
        rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
        if (!rm)
                goto out;