[Xen-changelog] [linux-2.6.18-xen] pvSCSI: add sanity checks

["Xen patchbot-linux-2.6.18-xen" <patchbot-linux-2.6.18-xen@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1215505782 -3600
# Node ID 92247f7e5d8ab7f64c7e0ed9c1c8afe8a9abf46d
# Parent  da710ff0899a034efa63d330efe9a14c07d50364
pvSCSI: add sanity checks

Signed-off-by: Tomonari Horikoshi <t.horikoshi@xxxxxxxxxxxxxx>
Signed-off-by: Jun Kamada <kama@xxxxxxxxxxxxxx>
---
 drivers/xen/scsiback/scsiback.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff -r da710ff0899a -r 92247f7e5d8a drivers/xen/scsiback/scsiback.c
--- a/drivers/xen/scsiback/scsiback.c   Mon Jul 07 13:52:16 2008 +0100
+++ b/drivers/xen/scsiback/scsiback.c   Tue Jul 08 09:29:42 2008 +0100
@@ -283,6 +283,13 @@ static int scsiback_gnttab_data_map(vscs
                        pending_req->sgl[i].offset = ring_req->seg[i].offset;
                        pending_req->sgl[i].length = ring_req->seg[i].length;
                        data_len += pending_req->sgl[i].length;
+
+                       barrier();
+                       if (pending_req->sgl[i].offset >= PAGE_SIZE ||
+                           pending_req->sgl[i].length > PAGE_SIZE ||
+                           pending_req->sgl[i].offset + 
pending_req->sgl[i].length > PAGE_SIZE)
+                               err |= 1;
+
                }
 
                if (err)
@@ -509,7 +516,7 @@ static int prepare_pending_reqs(struct v
 
        /* request range check from frontend */
        pending_req->sc_data_direction = ring_req->sc_data_direction;
-       rmb();
+       barrier();
        if ((pending_req->sc_data_direction != DMA_BIDIRECTIONAL) &&
                (pending_req->sc_data_direction != DMA_TO_DEVICE) &&
                (pending_req->sc_data_direction != DMA_FROM_DEVICE) &&
@@ -521,7 +528,7 @@ static int prepare_pending_reqs(struct v
        }
 
        pending_req->nr_segments = ring_req->nr_segments;
-       rmb();
+       barrier();
        if (pending_req->nr_segments > VSCSIIF_SG_TABLESIZE) {
                DPRINTK("scsiback: invalid parameter nr_seg = %d\n",
                        pending_req->nr_segments);
@@ -530,7 +537,7 @@ static int prepare_pending_reqs(struct v
        }
 
        pending_req->cmd_len = ring_req->cmd_len;
-       rmb();
+       barrier();
        if (pending_req->cmd_len > VSCSIIF_MAX_COMMAND_SIZE) {
                DPRINTK("scsiback: invalid parameter cmd_len = %d\n",
                        pending_req->cmd_len);

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog