Re: [Xen-ia64-devel] [PATCH] Fix a bug in xencomm_copy_from/to_guest()

[Isaku Yamahata <yamahata@xxxxxxxxxxxxx>]

Hi Kaz.

On Wed, Dec 27, 2006 at 06:27:26PM +0900, SUZUKI Kazuhiro wrote:
> diff -r 80c5b5914b79 xen/arch/ia64/xen/xencomm.c
> --- a/xen/arch/ia64/xen/xencomm.c     Wed Dec 20 14:55:02 2006 -0700
> +++ b/xen/arch/ia64/xen/xencomm.c     Wed Dec 27 18:03:10 2006 +0900
> @@ -148,6 +148,13 @@ xencomm_copy_from_guest(
>          pgoffset = src_paddr % PAGE_SIZE;
>          chunksz = PAGE_SIZE - pgoffset;
>  
> +        if (chunksz <= skip) {
> +            from_pos += chunksz;
> +            skip -= chunksz;
> +            i++;
> +            continue;
> +        }
> +
>          chunk_skip = min(chunksz, skip);
>          from_pos += chunk_skip;
>          chunksz -= chunk_skip;

This condition looks odd.
I guess the issues which you've seen is 
calling xencomm_copy_chunk_{to, from} with len = 0.
(If I'm wrong, correct me.)
The patch should looks like as follows.
And xen/common/xencomm.c should modified similary too.

--- xen/arch/ia64/xen/xencomm.c   2006-12-21 12:05:05.000000000 +0900
+++ xen/arch/ia64/xen/xencomm.c.new       2006-12-27 19:12:19.000000000 +0900
@@ -153,7 +153,7 @@ xencomm_copy_from_guest(
         chunksz -= chunk_skip;
         skip -= chunk_skip;
 
-        if (skip == 0) {
+        if (skip == 0 && chunksz > 0) {
             unsigned int bytes = min(chunksz, n - to_pos);
            int res;
 
@@ -295,7 +295,7 @@ xencomm_copy_to_guest(
         skip -= chunk_skip;
         dest_paddr += chunk_skip;
 
-        if (skip == 0) {
+        if (skip == 0 && chunksz > 0) {
             unsigned int bytes = min(chunksz, n - from_pos);
             int res;
-- 
yamahata

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel