rpms/xen/devel xen-3.2.0-block-rw-range-check.patch, NONE, 1.1 xen.spec, 1.210, 1.211

[Daniel P. Berrange (berrange)]

Author: berrange

Update of /cvs/pkgs/rpms/xen/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9582

Modified Files:
	xen.spec 
Added Files:
	xen-3.2.0-block-rw-range-check.patch 
Log Message:
Fix block device extents check (rhbz #433560)

xen-3.2.0-block-rw-range-check.patch:

--- NEW FILE xen-3.2.0-block-rw-range-check.patch ---
changeset:   17093:e3c722d483f5
user:        Keir Fraser <keir.fraser at citrix.com>
date:        Wed Feb 20 17:46:10 2008 +0000
files:       tools/ioemu/block.c
description:
ioemu: Do proper block device extent checks.
Signed-off-by: Ian Jackson <ian.jackson at eu.citrix.com>


diff -r 511ab2b89ced -r e3c722d483f5 tools/ioemu/block.c
--- a/tools/ioemu/block.c	Wed Feb 20 17:42:12 2008 +0000
+++ b/tools/ioemu/block.c	Wed Feb 20 17:46:10 2008 +0000
@@ -120,6 +120,24 @@ void path_combine(char *dest, int dest_s
     }
 }
 
+static int bdrv_rw_badreq_sectors(BlockDriverState *bs,
+				int64_t sector_num, int nb_sectors)
+{
+    return
+	nb_sectors < 0 ||
+	nb_sectors > bs->total_sectors ||
+	sector_num > bs->total_sectors - nb_sectors;
+}
+
+static int bdrv_rw_badreq_bytes(BlockDriverState *bs,
+				  int64_t offset, int count)
+{
+    int64_t size = bs->total_sectors << SECTOR_BITS;
+    return
+	count < 0 ||
+	count > size ||
+	offset > size - count;
+}
 
 void bdrv_register(BlockDriver *bdrv)
 {
@@ -372,6 +390,7 @@ int bdrv_open2(BlockDriverState *bs, con
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
+    bs->total_sectors = 0; /* driver will set if it does not do getlength */
     if (bs->opaque == NULL && drv->instance_size > 0)
         return -1;
     /* Note: for compatibility, we open disk image files as RDWR, and
@@ -437,6 +456,7 @@ void bdrv_close(BlockDriverState *bs)
         bs->drv = NULL;
 
         /* call the change callback */
+	bs->total_sectors = 0;
         bs->media_changed = 1;
         if (bs->change_cb)
             bs->change_cb(bs->change_opaque);
@@ -502,9 +522,8 @@ int bdrv_read(BlockDriverState *bs, int6
     if (!drv)
         return -ENOMEDIUM;
 
-    if (sector_num < 0)
-	return -EINVAL;
-
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
             memcpy(buf, bs->boot_sector_data, 512);
         sector_num++;
@@ -542,8 +561,8 @@ int bdrv_write(BlockDriverState *bs, int
         return -ENOMEDIUM;
     if (bs->read_only)
         return -EACCES;
-    if (sector_num < 0)
-	return -EINVAL;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);   
     }
@@ -666,6 +685,8 @@ int bdrv_pread(BlockDriverState *bs, int
         return -ENOMEDIUM;
     if (!drv->bdrv_pread)
         return bdrv_pread_em(bs, offset, buf1, count1);
+    if (bdrv_rw_badreq_bytes(bs, offset, count1))
+	return -EDOM;
     return drv->bdrv_pread(bs, offset, buf1, count1);
 }
 
@@ -681,6 +702,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
         return -ENOMEDIUM;
     if (!drv->bdrv_pwrite)
         return bdrv_pwrite_em(bs, offset, buf1, count1);
+    if (bdrv_rw_badreq_bytes(bs, offset, count1))
+	return -EDOM;
     return drv->bdrv_pwrite(bs, offset, buf1, count1);
 }
 
@@ -922,6 +945,8 @@ int bdrv_write_compressed(BlockDriverSta
         return -ENOMEDIUM;
     if (!drv->bdrv_write_compressed)
         return -ENOTSUP;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
 }
     
@@ -1067,7 +1092,9 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
 
     if (!drv)
         return NULL;
-    
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return NULL;
+
     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(buf, bs->boot_sector_data, 512);
@@ -1089,6 +1116,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
         return NULL;
     if (bs->read_only)
         return NULL;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return NULL;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);   
     }



Index: xen.spec
===================================================================
RCS file: /cvs/pkgs/rpms/xen/devel/xen.spec,v
retrieving revision 1.210
retrieving revision 1.211
diff -u -r1.210 -r1.211
--- xen.spec	18 Feb 2008 23:09:04 -0000	1.210
+++ xen.spec	23 Feb 2008 16:14:07 -0000	1.211
@@ -2,7 +2,7 @@
 
 # Always set these 3 tags
 %define base_version 3.2.0
-%define base_release 7
+%define base_release 8
 
 # Hypervisor ABI
 %define hv_abi  3.2
@@ -67,12 +67,13 @@
 Patch7: xen-hvm-kernel-boot-nonrelocatable.patch
 Patch8: xen-xenstore-cli.patch
 Patch9: xen-timer-mode.patch
+
 # Temporary hack see rhbz #431327
 Patch10: xen-disable-latex-docs.patch
 Patch13: xen-dumpdir.patch
-
 Patch14: xen-net-disable-bridge-by-default.patch
 Patch15: xen-net-disable-iptables-on-bridge.patch
+Patch16: xen-3.2.0-block-rw-range-check.patch
 
 Patch36: xen-qemu-bootmenu.patch
 
@@ -167,10 +168,12 @@
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
+
 %patch10 -p1
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16 -p1
 
 %patch36 -p1
 
@@ -453,6 +456,9 @@
 %{_libdir}/*.a
 
 %changelog
+* Sat Feb 23 2008 Daniel P. Berrange <berrange at redhat.com> - 3.2.0-8.fc9
+- Fix block device extents check (rhbz #433560)
+
 * Mon Feb 18 2008 Mark McLoughlin <markmc at redhat.com> - 3.2.0-7.fc9
 - Restore some network-bridge patches lost during 3.2.0 rebase