From: kfraser@localhost.localdomain Date: Mon, 23 Oct 2006 09:05:32 +0000 (+0100) Subject: [BLOCK] blkback: Fix first_sect check. X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~15585^2~23 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=7a57f20be7c4a776491c692c319a45256cb1c694;p=xen.git [BLOCK] blkback: Fix first_sect check. The blkback code checks first_sect by computing last_sect - first_sect + 1. If this is not positive then the request is rejected. Unfortunately, the calculation is stored in an unsigned integer before the check is made so negative values will not be rejected. This patch fixes this by explicitly comparing first_sect with last_sect. The blktap code is similar but it stores the difference in a signed integer so it's okay. Signed-off-by: Herbert Xu --- diff --git a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c index 106b4bf99d..37b33cbe4d 100644 --- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c +++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c @@ -375,7 +375,7 @@ static void dispatch_rw_block_io(blkif_t *blkif, req->seg[i].first_sect + 1; if ((req->seg[i].last_sect >= (PAGE_SIZE >> 9)) || - (seg[i].nsec <= 0)) + (req->seg[i].last_sect < req->seg[i].first_sect)) goto fail_response; preq.nr_sects += seg[i].nsec;