1 files changed, 32 insertions, 13 deletions

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index a37aeba7dc1b..0666b5d14b88 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1543,7 +1543,21 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
         return r;
 }
 
-static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param)
+#define DM_PARAMS_VMALLOC       0x0001  /* Params alloced with vmalloc not kmalloc */
+#define DM_WIPE_BUFFER          0x0010  /* Wipe input buffer before returning from ioctl */
+
+static void free_params(struct dm_ioctl *param, size_t param_size, int param_flags)
+{
+        if (param_flags & DM_WIPE_BUFFER)
+                memset(param, 0, param_size);
+
+        if (param_flags & DM_PARAMS_VMALLOC)
+                vfree(param);
+        else
+                kfree(param);
+}
+
+static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param, int *param_flags)
 {
         struct dm_ioctl tmp, *dmi;
         int secure_data;
@@ -1556,10 +1570,21 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param)
 
         secure_data = tmp.flags & DM_SECURE_DATA_FLAG;
 
+        *param_flags = secure_data ? DM_WIPE_BUFFER : 0;
+
         /*
          * Try to avoid low memory issues when a device is suspended.
+         * Use kmalloc() rather than vmalloc() when we can.
          */
-        dmi = __vmalloc(tmp.data_size, GFP_NOIO | __GFP_REPEAT | __GFP_HIGH, PAGE_KERNEL);
+        dmi = NULL;
+        if (tmp.data_size <= KMALLOC_MAX_SIZE)
+                dmi = kmalloc(tmp.data_size, GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
+
+        if (!dmi) {
+                dmi = __vmalloc(tmp.data_size, GFP_NOIO | __GFP_REPEAT | __GFP_HIGH, PAGE_KERNEL);
+                *param_flags |= DM_PARAMS_VMALLOC;
+        }
+
         if (!dmi) {
                 if (secure_data && clear_user(user, tmp.data_size))
                         return -EFAULT;
@@ -1585,9 +1610,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param)
         return 0;
 
 bad:
-        if (secure_data)
-                memset(dmi, 0, tmp.data_size);
-        vfree(dmi);
+        free_params(dmi, tmp.data_size, *param_flags);
+
         return -EFAULT;
 }
 
@@ -1624,7 +1648,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
 static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
 {
         int r = 0;
-        int wipe_buffer;
+        int param_flags;
         unsigned int cmd;
         struct dm_ioctl *uninitialized_var(param);
         ioctl_fn fn = NULL;
@@ -1662,14 +1686,12 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
         /*
          * Copy the parameters into kernel space.
          */
-        r = copy_params(user, &param);
+        r = copy_params(user, &param, &param_flags);
 
         if (r)
                 return r;
 
         input_param_size = param->data_size;
-        wipe_buffer = param->flags & DM_SECURE_DATA_FLAG;
-
         r = validate_params(cmd, param);
         if (r)
                 goto out;
@@ -1684,10 +1706,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
                 r = -EFAULT;
 
 out:
-        if (wipe_buffer)
-                memset(param, 0, input_param_size);
-
-        vfree(param);
+        free_params(param, input_param_size, param_flags);
         return r;
 }