Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  isdn: mISDN: socket: fix information leak to userland
  netdev: can: Change mail address of Hans J. Koch
  pcnet_cs: add new_id
  net: Truncate recvfrom and sendto length to INT_MAX.
  RDS: Let rds_message_alloc_sgs() return NULL
  RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace
  RDS: Clean up error handling in rds_cmsg_rdma_args
  RDS: Return -EINVAL if rds_rdma_pages returns an error
  net: fix rds_iovec page count overflow
  can: pch_can: fix section mismatch warning by using a whitelisted name
  can: pch_can: fix sparse warning
  netxen_nic: Fix the tx queue manipulation bug in netxen_nic_probe
  ip_gre: fix fallback tunnel setup
  vmxnet: trivial annotation of protocol constant
  vmxnet3: remove unnecessary byteswapping in BAR writing macros
  ipv6/udp: report SndbufErrors and RcvbufErrors
  phy/marvell: rename 88ec048 to 88e1318s and fix mscr1 addr

1 files changed, 5 insertions, 0 deletions

diff --git a/net/rds/message.c b/net/rds/message.c
index a84545dae370..848cff45183b 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -224,6 +224,9 @@ struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents)
         WARN_ON(rm->m_used_sgs + nents > rm->m_total_sgs);
         WARN_ON(!nents);
 
+        if (rm->m_used_sgs + nents > rm->m_total_sgs)
+                return NULL;
+
         sg_ret = &sg_first[rm->m_used_sgs];
         sg_init_table(sg_ret, nents);
         rm->m_used_sgs += nents;
@@ -246,6 +249,8 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
         rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
         rm->data.op_nents = ceil(total_len, PAGE_SIZE);
         rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
+        if (!rm->data.op_sg)
+                return ERR_PTR(-ENOMEM);
 
         for (i = 0; i < rm->data.op_nents; ++i) {
                 sg_set_page(&rm->data.op_sg[i],