From 723c3e82004c2d39deed694653cde534216e5e5f Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 26 May 2011 12:33:41 +0100 Subject: [PATCH] xen/blkback: don't fail empty barrier requests The sector number on empty barrier requests may (will?) be uninitialized (neither bio_init() nor rq_init() set the respective fields), which allows for exceeding the actual (virtual) disk's size. Inspired by Konrad's "When writting barriers set the sector number to zero...", but instead of zapping the sector number (which is wrong for non-empty ones) just ignore the sector number when the sector count is zero. While at it also add overflow checking to the math in vbd_translate(). Signed-off-by: Jan Beulich --- drivers/xen/blkback/vbd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/xen/blkback/vbd.c b/drivers/xen/blkback/vbd.c index 8d5d9a14..bb03276e 100644 --- a/drivers/xen/blkback/vbd.c +++ b/drivers/xen/blkback/vbd.c @@ -108,8 +108,14 @@ int vbd_translate(struct phys_req *req, blkif_t *blkif, int operation) if ((operation != READ) && vbd->readonly) goto out; - if (unlikely((req->sector_number + req->nr_sects) > vbd_sz(vbd))) - goto out; + if (likely(req->nr_sects)) { + blkif_sector_t end = req->sector_number + req->nr_sects; + + if (unlikely(end < req->sector_number)) + goto out; + if (unlikely(end > vbd_sz(vbd))) + goto out; + } req->dev = vbd->pdevice; req->bdev = vbd->bdev; -- 2.39.5