[PATCH] fast_flush_area in blkback.c still broken after 55194bd55b86

[PATCH] fast_flush_area in blkback.c still broken after 55194bd55b86

[harry]

[-- Attachment #1: Type: text/plain, Size: 421 bytes --]

I think you need this patch otherwise you will be passing uninitialised
data from the stack to GNTTABOP_unmap_grant_ref in fast_flush_area.

Also, I think the memset of the pending_grant_handles array should
happen before you start using them so I moved it to before
blkif_xenbus_init.  I'm not sure if this is necessary or it might
possibly have to go even earlier.

Signed off by Harry Butterworth butterwo@uk.ibm.com.

[-- Attachment #2: fast-flush-area.diff --]
[-- Type: text/x-patch, Size: 983 bytes --]

diff -r 1a2756a11b6d -r 3951f76667d4 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c	Mon Nov  7 10:53:53 2005
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c	Mon Nov  7 11:08:33 2005
@@ -114,9 +114,9 @@
 		handle = pending_handle(idx, i);
 		if (handle == BLKBACK_INVALID_HANDLE)
 			continue;
-		unmap[i].host_addr      = MMAP_VADDR(idx, i);
-		unmap[i].dev_bus_addr   = 0;
-		unmap[i].handle         = handle;
+		unmap[invcount].host_addr      = MMAP_VADDR(idx, i);
+		unmap[invcount].dev_bus_addr   = 0;
+		unmap[invcount].handle         = handle;
 		pending_handle(idx, i)  = BLKBACK_INVALID_HANDLE;
 		invcount++;
 	}
@@ -516,9 +516,9 @@
 	ret = kernel_thread(blkio_schedule, 0, CLONE_FS | CLONE_FILES);
 	BUG_ON(ret < 0);
 
+	memset(pending_grant_handles,  BLKBACK_INVALID_HANDLE, MMAP_PAGES);
+
 	blkif_xenbus_init();
-
-	memset(pending_grant_handles,  BLKBACK_INVALID_HANDLE, MMAP_PAGES);
 
 	return 0;
 }

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH] fast_flush_area in blkback.c still broken after 55194bd55b86

[Keir Fraser]

On 7 Nov 2005, at 11:19, harry wrote:

> I think you need this patch otherwise you will be passing uninitialised
> data from the stack to GNTTABOP_unmap_grant_ref in fast_flush_area.
>
> Also, I think the memset of the pending_grant_handles array should
> happen before you start using them so I moved it to before
> blkif_xenbus_init.  I'm not sure if this is necessary or it might
> possibly have to go even earlier.

Two good catches. In fact the initialisation of pending_grant_handles 
was more seriously broken -- the use of memset was bogus since the 
array elements are u16's not u8's. So only half the array was being 
initialised, and high byte of the initialiser value was discarded. 
Where do we find these programmers.... :-)

  -- Keir