1 files changed, 31 insertions, 9 deletions

diff --git a/fs/xattr.c b/fs/xattr.c
index d6dfd247bb2..3c8c1cc333c 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -19,8 +19,9 @@
 #include <linux/export.h>
 #include <linux/fsnotify.h>
 #include <linux/audit.h>
-#include <asm/uaccess.h>
+#include <linux/vmalloc.h>
 
+#include <asm/uaccess.h>
 
 /*
  * Check permissions for extended attribute access.  This is a bit complicated
@@ -320,6 +321,7 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
 {
         int error;
         void *kvalue = NULL;
+        void *vvalue = NULL;    /* If non-NULL, we used vmalloc() */
         char kname[XATTR_NAME_MAX + 1];
 
         if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
@@ -334,13 +336,25 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
         if (size) {
                 if (size > XATTR_SIZE_MAX)
                         return -E2BIG;
-                kvalue = memdup_user(value, size);
-                if (IS_ERR(kvalue))
-                        return PTR_ERR(kvalue);
+                kvalue = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+                if (!kvalue) {
+                        vvalue = vmalloc(size);
+                        if (!vvalue)
+                                return -ENOMEM;
+                        kvalue = vvalue;
+                }
+                if (copy_from_user(kvalue, value, size)) {
+                        error = -EFAULT;
+                        goto out;
+                }
         }
 
         error = vfs_setxattr(d, kname, kvalue, size, flags);
-        kfree(kvalue);
+out:
+        if (vvalue)
+                vfree(vvalue);
+        else
+                kfree(kvalue);
         return error;
 }
 
@@ -492,13 +506,18 @@ listxattr(struct dentry *d, char __user *list, size_t size)
 {
         ssize_t error;
         char *klist = NULL;
+        char *vlist = NULL;     /* If non-NULL, we used vmalloc() */
 
         if (size) {
                 if (size > XATTR_LIST_MAX)
                         size = XATTR_LIST_MAX;
-                klist = kmalloc(size, GFP_KERNEL);
-                if (!klist)
-                        return -ENOMEM;
+                klist = kmalloc(size, __GFP_NOWARN | GFP_KERNEL);
+                if (!klist) {
+                        vlist = vmalloc(size);
+                        if (!vlist)
+                                return -ENOMEM;
+                        klist = vlist;
+                }
         }
 
         error = vfs_listxattr(d, klist, size);
@@ -510,7 +529,10 @@ listxattr(struct dentry *d, char __user *list, size_t size)
                    than XATTR_LIST_MAX bytes. Not possible. */
                 error = -E2BIG;
         }
-        kfree(klist);
+        if (vlist)
+                vfree(vlist);
+        else
+                kfree(klist);
         return error;
 }