1 files changed, 18 insertions, 4 deletions

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index d367783f6920..86dad1eee549 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -308,6 +308,16 @@ static void netem_reset(struct Qdisc *sch)
         qdisc_watchdog_cancel(&q->watchdog);
 }
 
+static void dist_free(struct disttable *d)
+{
+        if (d) {
+                if (is_vmalloc_addr(d))
+                        vfree(d);
+                else
+                        kfree(d);
+        }
+}
+
 /*
  * Distribution data is a variable size payload containing
  * signed 16 bit values.
@@ -315,16 +325,20 @@ static void netem_reset(struct Qdisc *sch)
 static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        unsigned long n = nla_len(attr)/sizeof(__s16);
+        size_t n = nla_len(attr)/sizeof(__s16);
         const __s16 *data = nla_data(attr);
         spinlock_t *root_lock;
         struct disttable *d;
         int i;
+        size_t s;
 
         if (n > 65536)
                 return -EINVAL;
 
-        d = kmalloc(sizeof(*d) + n*sizeof(d->table[0]), GFP_KERNEL);
+        s = sizeof(struct disttable) + n * sizeof(s16);
+        d = kmalloc(s, GFP_KERNEL);
+        if (!d)
+                d = vmalloc(s);
         if (!d)
                 return -ENOMEM;
 
@@ -335,7 +349,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
         root_lock = qdisc_root_sleeping_lock(sch);
 
         spin_lock_bh(root_lock);
-        kfree(q->delay_dist);
+        dist_free(q->delay_dist);
         q->delay_dist = d;
         spin_unlock_bh(root_lock);
         return 0;
@@ -556,7 +570,7 @@ static void netem_destroy(struct Qdisc *sch)
 
         qdisc_watchdog_cancel(&q->watchdog);
         qdisc_destroy(q->qdisc);
-        kfree(q->delay_dist);
+        dist_free(q->delay_dist);
 }
 
 static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)