[Xen-changelog] [xen-3.1-testing] blkback: Sanity-check nr_segments parameter.

["Xen patchbot-3.1-testing" <patchbot-3.1-testing@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir@xxxxxxxxxxxxx>
# Date 1194546736 0
# Node ID aa5d92821bb28a42d02c85daf20ba8d4de986478
# Parent  d000dead48c493898be1ea3ec8e400db0e5f4670
blkback: Sanity-check nr_segments parameter.
From: Gerd Hoffmann <kraxel@xxxxxxxxxx>
Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxxxxx>
linux-2.6.18-xen changeset:   309:cf8b6cafa2f0a8ba698322786cc78ae28a1b0f60
linux-2.6.18-xen date:        Thu Nov 08 18:26:08 2007 +0000
---
 linux-2.6-xen-sparse/include/xen/blkif.h |   12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diff -r d000dead48c4 -r aa5d92821bb2 linux-2.6-xen-sparse/include/xen/blkif.h
--- a/linux-2.6-xen-sparse/include/xen/blkif.h  Tue Nov 06 11:50:32 2007 +0000
+++ b/linux-2.6-xen-sparse/include/xen/blkif.h  Thu Nov 08 18:32:16 2007 +0000
@@ -72,25 +72,29 @@ enum blkif_protocol {
 
 static void inline blkif_get_x86_32_req(blkif_request_t *dst, 
blkif_x86_32_request_t *src)
 {
-       int i;
+       int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
        dst->operation = src->operation;
        dst->nr_segments = src->nr_segments;
        dst->handle = src->handle;
        dst->id = src->id;
        dst->sector_number = src->sector_number;
-       for (i = 0; i < src->nr_segments; i++)
+       if (n > src->nr_segments)
+               n = src->nr_segments;
+       for (i = 0; i < n; i++)
                dst->seg[i] = src->seg[i];
 }
 
 static void inline blkif_get_x86_64_req(blkif_request_t *dst, 
blkif_x86_64_request_t *src)
 {
-       int i;
+       int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
        dst->operation = src->operation;
        dst->nr_segments = src->nr_segments;
        dst->handle = src->handle;
        dst->id = src->id;
        dst->sector_number = src->sector_number;
-       for (i = 0; i < src->nr_segments; i++)
+       if (n > src->nr_segments)
+               n = src->nr_segments;
+       for (i = 0; i < n; i++)
                dst->seg[i] = src->seg[i];
 }
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog