ia64/linux-2.6.18-xen.hg

changeset 595:92247f7e5d8a

pvSCSI: add sanity checks

Signed-off-by: Tomonari Horikoshi <t.horikoshi@jp.fujitsu.com>
Signed-off-by: Jun Kamada <kama@jp.fujitsu.com>
author Keir Fraser <keir.fraser@citrix.com>
date Tue Jul 08 09:29:42 2008 +0100 (2008-07-08)
parents da710ff0899a
children 132bae41625f
files drivers/xen/scsiback/scsiback.c
line diff
     1.1 --- a/drivers/xen/scsiback/scsiback.c	Mon Jul 07 13:52:16 2008 +0100
     1.2 +++ b/drivers/xen/scsiback/scsiback.c	Tue Jul 08 09:29:42 2008 +0100
     1.3 @@ -283,6 +283,13 @@ static int scsiback_gnttab_data_map(vscs
     1.4  			pending_req->sgl[i].offset = ring_req->seg[i].offset;
     1.5  			pending_req->sgl[i].length = ring_req->seg[i].length;
     1.6  			data_len += pending_req->sgl[i].length;
     1.7 +
     1.8 +			barrier();
     1.9 +			if (pending_req->sgl[i].offset >= PAGE_SIZE ||
    1.10 +			    pending_req->sgl[i].length > PAGE_SIZE ||
    1.11 +			    pending_req->sgl[i].offset + pending_req->sgl[i].length > PAGE_SIZE)
    1.12 +				err |= 1;
    1.13 +
    1.14  		}
    1.15  
    1.16  		if (err)
    1.17 @@ -509,7 +516,7 @@ static int prepare_pending_reqs(struct v
    1.18  
    1.19  	/* request range check from frontend */
    1.20  	pending_req->sc_data_direction = ring_req->sc_data_direction;
    1.21 -	rmb();
    1.22 +	barrier();
    1.23  	if ((pending_req->sc_data_direction != DMA_BIDIRECTIONAL) &&
    1.24  		(pending_req->sc_data_direction != DMA_TO_DEVICE) &&
    1.25  		(pending_req->sc_data_direction != DMA_FROM_DEVICE) &&
    1.26 @@ -521,7 +528,7 @@ static int prepare_pending_reqs(struct v
    1.27  	}
    1.28  
    1.29  	pending_req->nr_segments = ring_req->nr_segments;
    1.30 -	rmb();
    1.31 +	barrier();
    1.32  	if (pending_req->nr_segments > VSCSIIF_SG_TABLESIZE) {
    1.33  		DPRINTK("scsiback: invalid parameter nr_seg = %d\n",
    1.34  			pending_req->nr_segments);
    1.35 @@ -530,7 +537,7 @@ static int prepare_pending_reqs(struct v
    1.36  	}
    1.37  
    1.38  	pending_req->cmd_len = ring_req->cmd_len;
    1.39 -	rmb();
    1.40 +	barrier();
    1.41  	if (pending_req->cmd_len > VSCSIIF_MAX_COMMAND_SIZE) {
    1.42  		DPRINTK("scsiback: invalid parameter cmd_len = %d\n",
    1.43  			pending_req->cmd_len);