---

yaml --- r: 373391 b: refs/heads/master c: 56fc565 h: refs/heads/master i: 373389: aeb51d2 373387: 9777975 373383: 7a05ba9 373375: 02dbabe v: v3
git-mirror · May 2, 2013 · abbc310 · abbc310
1 parent 72f613c
commit abbc310
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5df521b1eecf276c4bae8ffb7945acef45530449
+refs/heads/master: 56fc5659162965ce3018a34c6bb8a022f3a3b33c
diff --git a/trunk/net/ceph/messenger.c b/trunk/net/ceph/messenger.c
@@ -839,9 +839,10 @@ static void ceph_msg_data_pages_cursor_init(struct ceph_msg_data *data,
 	page_count = calc_pages_for(data->alignment, (u64)data->length);
 	cursor->page_offset = data->alignment & ~PAGE_MASK;
 	cursor->page_index = 0;
-	BUG_ON(page_count > (int) USHRT_MAX);
-	cursor->page_count = (unsigned short) page_count;
-	cursor->last_piece = length <= PAGE_SIZE;
+	BUG_ON(page_count > (int)USHRT_MAX);
+	cursor->page_count = (unsigned short)page_count;
+	BUG_ON(length > SIZE_MAX - cursor->page_offset);
+	cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE;
 }
 
 static struct page *ceph_msg_data_pages_next(struct ceph_msg_data *data,