From: Andreas Dilger Date: Thu, 9 Nov 2023 00:10:05 +0000 (-0700) Subject: EX-8270 sptlrpc: don't crash for too-large chunk size X-Git-Url: https://git.whamcloud.com/?a=commitdiff_plain;h=143caaa0ea9fd240de547184540032852f85b99e;p=fs%2Flustre-release.git EX-8270 sptlrpc: don't crash for too-large chunk size If the chunk size is too large, don't fall off the end of the page_pool[] array with a large "order". Test-Parameters: trivial Fixes: d945f1b064 ("EX-6261 ptlrpc: extend sec bulk functionality") Signed-off-by: Andreas Dilger Change-Id: I192ac1b227f1cab8405f6657e754101d353ebbe5 Reviewed-on: https://review.whamcloud.com/c/ex/lustre-release/+/53044 Tested-by: jenkins Tested-by: Maloo Reviewed-by: Artem Blagodarenko --- diff --git a/lustre/ptlrpc/sec_bulk.c b/lustre/ptlrpc/sec_bulk.c index 9ec2d56..2e9bdb1 100644 --- a/lustre/ptlrpc/sec_bulk.c +++ b/lustre/ptlrpc/sec_bulk.c @@ -671,16 +671,18 @@ static inline int __sptlrpc_pool_get_pages(void *array, unsigned int count, unsigned int order, void **(*page_from)(void *, int)) { - struct ptlrpc_page_pool *page_pool = page_pools[order]; + struct ptlrpc_page_pool *page_pool; wait_queue_entry_t waitlink; unsigned long this_idle = -1; u64 tick_ns = 0; int p_idx, g_idx; int i, rc = 0; - if (!array || count <= 0 || count > page_pool->ppp_max_pages) + if (!array || count <= 0 || order >= POOLS_COUNT || + count > page_pools[order]->ppp_max_pages) return -EINVAL; + page_pool = page_pools[order]; spin_lock(&page_pool->ppp_lock); page_pool->ppp_st_access++; @@ -842,7 +844,7 @@ static int __sptlrpc_pool_put_pages(void *array, unsigned int count, LASSERTF(order < POOLS_COUNT, "count %u, pool %u\n", count, order); - if (!array) { + if (!array || order >= POOLS_COUNT) { CERROR("Faled to put %u pages, from pool %u\n", count, order); return -EINVAL;