rpms/xen/F-7 xen-3.1.2-block-rw-range-check.patch, NONE, 1.1 .cvsignore, 1.33, 1.34 xen.spec, 1.189, 1.190

[Daniel P. Berrange (berrange)]

Author: berrange

Update of /cvs/pkgs/rpms/xen/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv5357

Modified Files:
	.cvsignore xen.spec 
Added Files:
	xen-3.1.2-block-rw-range-check.patch 
Log Message:
Fix block device extents check (rhbz #433560)

xen-3.1.2-block-rw-range-check.patch:

--- NEW FILE xen-3.1.2-block-rw-range-check.patch ---
diff -rup xen-3.1.2-src.orig/tools/ioemu/block.c xen-3.1.2-src.new/tools/ioemu/block.c
--- xen-3.1.2-src.orig/tools/ioemu/block.c	2007-11-14 18:35:27.000000000 -0500
+++ xen-3.1.2-src.new/tools/ioemu/block.c	2008-02-23 11:44:00.000000000 -0500
@@ -109,6 +109,15 @@ kern_return_t GetBSDPath( io_iterator_t 
 
 #endif
 
+static int bdrv_rw_badreq_sectors(BlockDriverState *bs,
+				int64_t sector_num, int nb_sectors)
+{
+    return
+	nb_sectors < 0 ||
+	nb_sectors > bs->total_sectors ||
+	sector_num > bs->total_sectors - nb_sectors;
+}
+
 void bdrv_register(BlockDriver *bdrv)
 {
     bdrv->next = first_drv;
@@ -307,6 +316,7 @@ int bdrv_open2(BlockDriverState *bs, con
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
+    bs->total_sectors = 0; /* driver will set if it does not do getlength */
     if (bs->opaque == NULL && drv->instance_size > 0)
         return -1;
     
@@ -356,6 +366,7 @@ void bdrv_close(BlockDriverState *bs)
         bs->opaque = NULL;
         bs->drv = NULL;
         bs->inserted = 0;
+	bs->total_sectors = 0;
 
         /* call the change callback */
         if (bs->change_cb)
@@ -420,8 +431,8 @@ int bdrv_read(BlockDriverState *bs, int6
 
     if (!bs->inserted)
         return -1;
-    if (sector_num < 0)
-	return -1;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
 
     while (nb_sectors > 0) {
         if (sector_num == 0 && bs->boot_sector_enabled) {
@@ -460,8 +471,8 @@ int bdrv_write(BlockDriverState *bs, int
         return -1;
     if (bs->read_only)
         return -1;
-    if (sector_num < 0)
-	return -1;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);   
     }


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/xen/F-7/.cvsignore,v
retrieving revision 1.33
retrieving revision 1.34
diff -u -r1.33 -r1.34
--- .cvsignore	1 Dec 2007 22:12:16 -0000	1.33
+++ .cvsignore	28 Feb 2008 00:59:25 -0000	1.34
@@ -1,3 +1,4 @@
+i686
 LibVNCServer-0.8.2.tar.gz
 *.rpm
 .build*.log


Index: xen.spec
===================================================================
RCS file: /cvs/pkgs/rpms/xen/F-7/xen.spec,v
retrieving revision 1.189
retrieving revision 1.190
diff -u -r1.189 -r1.190
--- xen.spec	1 Dec 2007 22:12:16 -0000	1.189
+++ xen.spec	28 Feb 2008 00:59:25 -0000	1.190
@@ -3,7 +3,7 @@
 Summary: Xen is a virtual machine monitor
 Name:    xen
 Version: 3.1.2
-Release: 1%{dist}
+Release: 2%{dist}
 Group:   Development/Libraries
 License: GPL
 URL:     http://www.cl.cam.ac.uk/Research/SRG/netos/xen/index.html
@@ -38,6 +38,8 @@
 # Performance fix for listing domains
 Patch280: xen-xs-transactions.patch
 
+Patch281: xen-%{version}-block-rw-range-check.patch
+
 # libVNCserver patches
 Patch300: vnc-thread-fixes.patch
 Patch301: vnc-invalid-fd.patch
@@ -135,6 +137,8 @@
 # performance patch
 %patch280 -p1
 
+%patch281 -p1
+
 # libVNCserver patches
 pushd LibVNCServer-0.8.2
 # thread locking fixes
@@ -266,6 +270,9 @@
 %{_libdir}/*.a
 
 %changelog
+* Sat Feb 23 2008 Daniel P. Berrange <berrange at redhat.com> - 3.1.2-2.fc7
+- Fix block device extents check (rhbz #433560)
+
 * Sat Dec  1 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.2-1.fc7
 - Upgrade to 3.1.2 bugfix release