xps: Transmit Packet Steering

[net-next-2.6.git] / fs / bio.c

diff --git a/fs/bio.c b/fs/bio.c
index e7bf6ca64dcf028caec480f4ecb82b2ff32d2463..4bd454fa844e3efc8c44755c7ea9847477f813ff 100644 (file)
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -370,6 +370,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
 {
        struct bio *bio;
 
+       if (nr_iovecs > UIO_MAXIOV)
+               return NULL;
+
        bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec),
                      gfp_mask);
        if (unlikely(!bio))
@@ -697,8 +700,12 @@ static void bio_free_map_data(struct bio_map_data *bmd)
 static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
                                               gfp_t gfp_mask)
 {
-       struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
+       struct bio_map_data *bmd;
+
+       if (iov_count > UIO_MAXIOV)
+               return NULL;
 
+       bmd = kmalloc(sizeof(*bmd), gfp_mask);
        if (!bmd)
                return NULL;
 
@@ -827,6 +834,12 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
                start = uaddr >> PAGE_SHIFT;
 
+               /*
+                * Overflow, abort
+                */
+               if (end < start)
+                       return ERR_PTR(-EINVAL);
+
                nr_pages += end - start;
                len += iov[i].iov_len;
        }
@@ -843,7 +856,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
        if (!bio)
                goto out_bmd;
 
-       bio->bi_rw |= (!write_to_vm << BIO_RW);
+       if (!write_to_vm)
+               bio->bi_rw |= REQ_WRITE;
 
        ret = 0;
 
@@ -954,6 +968,12 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
                unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
                unsigned long start = uaddr >> PAGE_SHIFT;
 
+               /*
+                * Overflow, abort
+                */
+               if (end < start)
+                       return ERR_PTR(-EINVAL);
+
                nr_pages += end - start;
                /*
                 * buffer must be aligned to at least hardsector size for now
@@ -981,7 +1001,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
                unsigned long start = uaddr >> PAGE_SHIFT;
                const int local_nr_pages = end - start;
                const int page_limit = cur_page + local_nr_pages;
-               
+
                ret = get_user_pages_fast(uaddr, local_nr_pages,
                                write_to_vm, &pages[cur_page]);
                if (ret < local_nr_pages) {
@@ -1024,7 +1044,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
         * set data direction, and check if mapped pages need bouncing
         */
        if (!write_to_vm)
-               bio->bi_rw |= (1 << BIO_RW);
+               bio->bi_rw |= REQ_WRITE;
 
        bio->bi_bdev = bdev;
        bio->bi_flags |= (1 << BIO_USER_MAPPED);