xen/blkback: don't fail empty barrier requests

The sector number on empty barrier requests may (will?) be
uninitialized (neither bio_init() nor rq_init() set the respective
fields), which allows for exceeding the actual (virtual) disk's size.

Inspired by Konrad's "When writting barriers set the sector number to
zero...", but instead of zapping the sector number (which is wrong for
non-empty ones) just ignore the sector number when the sector count is
zero.

While at it also add overflow checking to the math in vbd_translate().

Signed-off-by: Jan Beulich <jbeulich@novell.com>

diff --git a/drivers/xen/blkback/vbd.c b/drivers/xen/blkback/vbd.c
index 8d5d9a14142b8567b7157206327082aca9a74e9b..bb03276eecb9b8710a88d0584b54d98a2b4a7de9 100644 (file)
--- a/drivers/xen/blkback/vbd.c
+++ b/drivers/xen/blkback/vbd.c
@@ -108,8 +108,14 @@ int vbd_translate(struct phys_req *req, blkif_t *blkif, int operation)
        if ((operation != READ) && vbd->readonly)
                goto out;
 
-       if (unlikely((req->sector_number + req->nr_sects) > vbd_sz(vbd)))
-               goto out;
+       if (likely(req->nr_sects)) {
+               blkif_sector_t end = req->sector_number + req->nr_sects;
+
+               if (unlikely(end < req->sector_number))
+                       goto out;
+               if (unlikely(end > vbd_sz(vbd)))
+                       goto out;
+       }
 
        req->dev  = vbd->pdevice;
        req->bdev = vbd->bdev;