[BLOCK] blkback: Fix first_sect check.

The blkback code checks first_sect by computing last_sect - first_sect
+ 1. If this is not positive then the request is
rejected. Unfortunately, the calculation is stored in an unsigned
integer before the check is made so negative values will not be
rejected.

This patch fixes this by explicitly comparing first_sect with
last_sect.

The blktap code is similar but it stores the difference in a signed
integer so it's okay.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
index 106b4bf99ddb52fc4e3540f21ac8a2a907ad224c..37b33cbe4dfeaac08ec772c9c4d883e242619023 100644 (file)
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
@@ -375,7 +375,7 @@ static void dispatch_rw_block_io(blkif_t *blkif,
                        req->seg[i].first_sect + 1;
 
                if ((req->seg[i].last_sect >= (PAGE_SIZE >> 9)) ||
-                   (seg[i].nsec <= 0))
+                   (req->seg[i].last_sect < req->seg[i].first_sect))
                        goto fail_response;
                preq.nr_sects += seg[i].nsec;