From 2917b224d2dffbeb4e99799e43c56e10c7d9029f Mon Sep 17 00:00:00 2001 From: adilger Date: Fri, 27 May 2005 11:56:46 +0000 Subject: [PATCH] Branch b1_4 Don't LASSERT OST in ptlrpc if a client sends a bad bulk request. b=6345 --- lustre/ost/ost_handler.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lustre/ost/ost_handler.c b/lustre/ost/ost_handler.c index 4f5cf14..1a6857e 100644 --- a/lustre/ost/ost_handler.c +++ b/lustre/ost/ost_handler.c @@ -399,6 +399,12 @@ static int ost_brw_read(struct ptlrpc_request *req, struct obd_trans_info *oti) } niocount = ioo->ioo_bufcnt; + if (niocount > PTLRPC_MAX_BRW_PAGES) { + DEBUG_REQ(D_ERROR, req, "bulk has too many pages (%d)\n", + niocount); + GOTO(out, rc = -EFAULT); + } + remote_nb = lustre_swab_reqbuf(req, 2, niocount * sizeof(*remote_nb), lustre_swab_niobuf_remote); if (remote_nb == NULL) { @@ -585,6 +591,11 @@ static int ost_brw_write(struct ptlrpc_request *req, struct obd_trans_info *oti) CERROR("Missing/short ioobj\n"); GOTO(out, rc = -EFAULT); } + if (objcount > 1) { + CERROR("too many ioobjs (%d)\n", objcount); + GOTO(out, rc = -EFAULT); + } + ioo = lustre_msg_buf (req->rq_reqmsg, 1, objcount * sizeof(*ioo)); LASSERT (ioo != NULL); for (niocount = i = 0; i < objcount; i++) { @@ -597,6 +608,12 @@ static int ost_brw_write(struct ptlrpc_request *req, struct obd_trans_info *oti) niocount += ioo[i].ioo_bufcnt; } + if (niocount > PTLRPC_MAX_BRW_PAGES) { + DEBUG_REQ(D_ERROR, req, "bulk has too many pages (%d)\n", + niocount); + GOTO(out, rc = -EFAULT); + } + remote_nb = lustre_swab_reqbuf(req, 2, niocount * sizeof(*remote_nb), lustre_swab_niobuf_remote); if (remote_nb == NULL) { -- 1.8.3.1