EX-8270 sptlrpc: don't crash for too-large chunk size

If the chunk size is too large, don't fall off the
end of the page_pool[] array with a large "order".

Test-Parameters: trivial
Fixes: d945f1b064 ("EX-6261 ptlrpc: extend sec bulk functionality")
Signed-off-by: Andreas Dilger <adilger@whamcloud.com>
Change-Id: I192ac1b227f1cab8405f6657e754101d353ebbe5
Reviewed-on: https://review.whamcloud.com/c/ex/lustre-release/+/53044
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Artem Blagodarenko <ablagodarenko@ddn.com>

diff --git a/lustre/ptlrpc/sec_bulk.c b/lustre/ptlrpc/sec_bulk.c
index 9ec2d56..2e9bdb1 100644 (file)
--- a/lustre/ptlrpc/sec_bulk.c
+++ b/lustre/ptlrpc/sec_bulk.c
@@ -671,16 +671,18 @@ static inline int __sptlrpc_pool_get_pages(void *array, unsigned int count,
                                           unsigned int order,
                                           void **(*page_from)(void *, int))
 {
-       struct ptlrpc_page_pool *page_pool = page_pools[order];
+       struct ptlrpc_page_pool *page_pool;
        wait_queue_entry_t waitlink;
        unsigned long this_idle = -1;
        u64 tick_ns = 0;
        int p_idx, g_idx;
        int i, rc = 0;
 
-       if (!array || count <= 0 || count > page_pool->ppp_max_pages)
+       if (!array || count <= 0 || order >= POOLS_COUNT ||
+           count > page_pools[order]->ppp_max_pages)
                return -EINVAL;
 
+       page_pool = page_pools[order];
        spin_lock(&page_pool->ppp_lock);
 
        page_pool->ppp_st_access++;
@@ -842,7 +844,7 @@ static int __sptlrpc_pool_put_pages(void *array, unsigned int count,
 
        LASSERTF(order < POOLS_COUNT, "count %u, pool %u\n",
                 count, order);
-       if (!array) {
+       if (!array || order >= POOLS_COUNT) {
                CERROR("Faled to put %u pages, from pool %u\n",
                       count, order);
                return -EINVAL;