Skip to contentSkip to conversation

fast_flush_area in blkback.c still broken after 55194bd55b86

PATCH In review harry 2 participants 2 messages Nov 7, 2005

lore
Share & tools
lore

harry

author
#0 lore raw

PATCH 1/1 fast_flush_area in blkback.c still broken after 55194bd55b86

I think you need this patch otherwise you will be passing uninitialised data from the stack to GNTTABOP_unmap_grant_ref in fast_flush_area.

Also, I think the memset of the pending_grant_handles array should happen before you start using them so I moved it to before blkif_xenbus_init. I'm not sure if this is necessary or it might possibly have to go even earlier.

Signed off by Harry Butterworth [email protected].

linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c +5 -5
diff -r 1a2756a11b6d -r 3951f76667d4 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
@@ -114,9 +114,9 @@
 		handle = pending_handle(idx, i);
 		if (handle == BLKBACK_INVALID_HANDLE)
 			continue;
-		unmap[i].host_addr      = MMAP_VADDR(idx, i);
-		unmap[i].dev_bus_addr   = 0;
-		unmap[i].handle         = handle;
+		unmap[invcount].host_addr      = MMAP_VADDR(idx, i);
+		unmap[invcount].dev_bus_addr   = 0;
+		unmap[invcount].handle         = handle;
 		pending_handle(idx, i)  = BLKBACK_INVALID_HANDLE;
 		invcount++;
 	}

@@ -516,9 +516,9 @@
 	ret = kernel_thread(blkio_schedule, 0, CLONE_FS | CLONE_FILES);
 	BUG_ON(ret < 0);
 
+	memset(pending_grant_handles,  BLKBACK_INVALID_HANDLE, MMAP_PAGES);
+
 	blkif_xenbus_init();
-
-	memset(pending_grant_handles,  BLKBACK_INVALID_HANDLE, MMAP_PAGES);
 
 	return 0;
 }

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

#1 lore raw
Quoted 7 lines · harry

I think you need this patch otherwise you will be passing uninitialised data from the stack to GNTTABOP_unmap_grant_ref in fast_flush_area.

Also, I think the memset of the pending_grant_handles array should happen before you start using them so I moved it to before blkif_xenbus_init. I'm not sure if this is necessary or it might possibly have to go even earlier.

Two good catches. In fact the initialisation of pending_grant_handles was more seriously broken -- the use of memset was bogus since the array elements are u16's not u8's. So only half the array was being initialised, and high byte of the initialiser value was discarded. Where do we find these programmers.... :-)

-- Keir