rds: limit the size allocated by rds_message_alloc()

[uclinux-h8/linux.git] / net / rds / message.c

diff --git a/net/rds/message.c b/net/rds/message.c
index f0a4658..aff589c 100644 (file)
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -197,6 +197,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
        struct rds_message *rm;
 
+       if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+               return NULL;
+
        rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
        if (!rm)
                goto out;