X-Git-Url: https://git.kernelconcepts.de/?a=blobdiff_plain;f=net%2Frds%2Frdma.c;h=f7d8c08bd6b2d97d5f74b9345c2a9054c8dc23a7;hb=bd378dd6df5ca43021a49f72441a6c14d9784bed;hp=8dc83d2caa58d02d7036ea697a5fac65f470b564;hpb=48ec2b53fe6a7244d62c74876ae00b0d7e03b4c5;p=karo-tx-linux.git

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 8dc83d2caa58..f7d8c08bd6b2 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -447,7 +447,7 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
 		goto out;
 	}
 
-	if (args->nr_local > (u64)UINT_MAX) {
+	if (args->nr_local > UIO_MAXIOV) {
 		ret = -EMSGSIZE;
 		goto out;
 	}
@@ -473,6 +473,14 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
 
 		max_pages = max(nr, max_pages);
 		nr_pages += nr;
+
+		/*
+		 * nr_pages for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
+		 * so tot_pages cannot overflow without first going negative.
+		 */
+		if ((int)nr_pages < 0)
+			ret = -EINVAL;
+			goto out;
 	}
 
 	pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);