diff options
author | Keir Fraser <keir.fraser@citrix.com> | 2009-04-14 11:21:45 +0100 |
---|---|---|
committer | Keir Fraser <keir.fraser@citrix.com> | 2009-04-14 11:21:45 +0100 |
commit | 0c75fee1bc3154c21078c61787a52058aae984e2 (patch) | |
tree | 26c9653c047902fd135d07ed584924658cdba00d | |
parent | 382b95f627a91a75545799f36534dcf6d145381e (diff) | |
download | xen-0c75fee1bc3154c21078c61787a52058aae984e2.tar.gz xen-0c75fee1bc3154c21078c61787a52058aae984e2.tar.bz2 xen-0c75fee1bc3154c21078c61787a52058aae984e2.zip |
minios: fix a memory corruption in blkfront
The corruption happens every time we pass a sector aligned buffer
(instead of a page aligned buffer) to blkfront_aio. To trigger the COW
we have to write at least a byte to each page of the buffer, but we
must be careful not to overwrite useful content.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-rw-r--r-- | extras/mini-os/blkfront.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/extras/mini-os/blkfront.c b/extras/mini-os/blkfront.c index d4b0ea54ce..75add45fb4 100644 --- a/extras/mini-os/blkfront.c +++ b/extras/mini-os/blkfront.c @@ -317,19 +317,21 @@ void blkfront_aio(struct blkfront_aiocb *aiocbp, int write) req->sector_number = aiocbp->aio_offset / dev->info.sector_size; for (j = 0; j < n; j++) { + req->seg[j].first_sect = 0; + req->seg[j].last_sect = PAGE_SIZE / dev->info.sector_size - 1; + } + req->seg[0].first_sect = ((uintptr_t)aiocbp->aio_buf & ~PAGE_MASK) / dev->info.sector_size; + req->seg[n-1].last_sect = (((uintptr_t)aiocbp->aio_buf + aiocbp->aio_nbytes - 1) & ~PAGE_MASK) / dev->info.sector_size; + for (j = 0; j < n; j++) { uintptr_t data = start + j * PAGE_SIZE; if (!write) { /* Trigger CoW if needed */ - *(char*)data = 0; + *(char*)(data + (req->seg[j].first_sect << 9)) = 0; barrier(); } aiocbp->gref[j] = req->seg[j].gref = gnttab_grant_access(dev->dom, virtual_to_mfn(data), write); - req->seg[j].first_sect = 0; - req->seg[j].last_sect = PAGE_SIZE / dev->info.sector_size - 1; } - req->seg[0].first_sect = ((uintptr_t)aiocbp->aio_buf & ~PAGE_MASK) / dev->info.sector_size; - req->seg[n-1].last_sect = (((uintptr_t)aiocbp->aio_buf + aiocbp->aio_nbytes - 1) & ~PAGE_MASK) / dev->info.sector_size; dev->ring.req_prod_pvt = i + 1; |