- if (len < required_len) {
- CERROR("len: %d, required_len %d\n", len, required_len);
- CERROR("bufcount: %d\n", m->lm_bufcount);
- for (i = 0; i < m->lm_bufcount; i++)
- CERROR("buffer %d length %d\n", i, m->lm_buflens[i]);
- return -EINVAL;
- }
+ for (i = 0; i < m->lm_bufcount; i++) {
+ if (swabbed)
+ __swab32s(&m->lm_buflens[i]);
+ buflen = cfs_size_round(m->lm_buflens[i]);
+ if (buflen < 0 || buflen > PTLRPC_MAX_BUFLEN) {
+ CERROR("buffer %d length %d is not valid\n", i, buflen);
+ return -EINVAL;
+ }
+ required_len += buflen;
+ }
+ if (len < required_len || required_len > PTLRPC_MAX_BUFLEN) {
+ CERROR("len: %d, required_len %d, bufcount: %d\n",
+ len, required_len, m->lm_bufcount);
+ for (i = 0; i < m->lm_bufcount; i++)
+ CERROR("buffer %d length %d\n", i, m->lm_buflens[i]);
+ return -EINVAL;
+ }