The patch titled Subject: drivers/message/i2o/i2o_config.c: bound allocation has been removed from the -mm tree. Its filename was drivers-message-i2o-i2o_configc-bound-allocation.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Alan Cox <alan@xxxxxxxxxxxxxxx> Subject: drivers/message/i2o/i2o_config.c: bound allocation Fix a case where users can try to allocate arbitarily large amounts of memory. 64K is overkill for a config request so apply an upper bound. Signed-off-by: Alan Cox <alan@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/message/i2o/i2o_config.c | 7 +++++++ 1 file changed, 7 insertions(+) diff -puN drivers/message/i2o/i2o_config.c~drivers-message-i2o-i2o_configc-bound-allocation drivers/message/i2o/i2o_config.c --- a/drivers/message/i2o/i2o_config.c~drivers-message-i2o-i2o_configc-bound-allocation +++ a/drivers/message/i2o/i2o_config.c @@ -188,6 +188,13 @@ static int i2o_cfg_parms(unsigned long a if (!dev) return -ENXIO; + /* + * Stop users being able to try and allocate arbitary amounts + * of DMA space. 64K is way more than sufficient for this. + */ + if (kcmd.oplen > 65536) + return -EMSGSIZE; + ops = memdup_user(kcmd.opbuf, kcmd.oplen); if (IS_ERR(ops)) return PTR_ERR(ops); _ Patches currently in -mm which might be from alan@xxxxxxxxxxxxxxx are origin.patch linux-next.patch ppc-e500_tlb-memset-clears-nothing.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html