From 629515f113e28938b6c88f210ed6bcd6d0dfefc0 Mon Sep 17 00:00:00 2001
From: Xi Wang <xi.wang@gmail.com>
Date: Wed, 6 Jun 2012 19:35:55 -0500
Subject: [PATCH] --- yaml --- r: 320278 b: refs/heads/master c:
 a5506049500b30dbc5edb4d07a3577477c1f3643 h: refs/heads/master v: v3

---
 [refs]                  | 2 +-
 trunk/net/ceph/osdmap.c | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 5b33df6ee38c..33d98927fb71 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e91a9b639a691e0982088b5954eaafb5a25c8f1c
+refs/heads/master: a5506049500b30dbc5edb4d07a3577477c1f3643
diff --git a/trunk/net/ceph/osdmap.c b/trunk/net/ceph/osdmap.c
index d70aaca4a45d..d3de09f519b2 100644
--- a/trunk/net/ceph/osdmap.c
+++ b/trunk/net/ceph/osdmap.c
@@ -893,6 +893,10 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
 			(void) __remove_pg_mapping(&map->pg_temp, pgid);
 
 			/* insert */
+			if (pglen > (UINT_MAX - sizeof(*pg)) / sizeof(u32)) {
+				err = -EINVAL;
+				goto bad;
+			}
 			pg = kmalloc(sizeof(*pg) + sizeof(u32)*pglen, GFP_NOFS);
 			if (!pg) {
 				err = -ENOMEM;