From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Jan Beulich" <JBeulich@novell.com>
Subject: [PATCH] linux-2.6.18/blkfront: fix data size for
	xenbus_gather in connect()
Date: Fri, 06 May 2011 16:39:09 +0100
Message-ID: <4DC4323D0200007800040189@vpn.id2.novell.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=__PartFAD67E0D.0__="
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
Cc: marmarek@mimuw.edu.pl
List-Id: xen-devel@lists.xenproject.org

This is a MIME message. If you are reading this text, you may want to 
consider changing to a mail reader or gateway that understands how to 
properly handle MIME multipart messages.

--=__PartFAD67E0D.0__=
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

From: Marek Marczykowski <marmarek@mimuw.edu.pl>

barrier variable is int, not long. This overflow caused another variable
override: "err" (in PV code) and "binfo" (in xenlinux code -
drivers/xen/blkfront/blkfront.c). The later caused incorrect device
flags (RO/removable etc).

Signed-off-by: Marek Marczykowski <marmarek@mimuw.edu.pl>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>

--- a/drivers/xen/blkfront/blkfront.c
+++ b/drivers/xen/blkfront/blkfront.c
@@ -364,7 +364,7 @@ static void connect(struct blkfront_info
 	}
=20
 	err =3D xenbus_gather(XBT_NIL, info->xbdev->otherend,
-			    "feature-barrier", "%lu", &info->feature_barrie=
r,
+			    "feature-barrier", "%d", &info->feature_barrier=
,
 			    NULL);
 	if (err)
 		info->feature_barrier =3D 0;




--=__PartFAD67E0D.0__=
Content-Type: text/plain; name="xen-blkfront-barrier-var.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename="xen-blkfront-barrier-var.patch"

From: Marek Marczykowski <marmarek@mimuw.edu.pl>=0ASubject: blkfront: fix =
data size for xenbus_gather in connect()=0A=0Abarrier variable is int, not =
long. This overflow caused another variable=0Aoverride: "err" (in PV code) =
and "binfo" (in xenlinux code -=0Adrivers/xen/blkfront/blkfront.c). The =
later caused incorrect device=0Aflags (RO/removable etc).=0A=0ASigned-off-b=
y: Marek Marczykowski <marmarek@mimuw.edu.pl>=0AAcked-by: Ian Campbell =
<ian.campbell@citrix.com>=0ASigned-off-by: Jan Beulich <jbeulich@novell.com=
>=0A=0A--- a/drivers/xen/blkfront/blkfront.c=0A+++ b/drivers/xen/blkfront/b=
lkfront.c=0A@@ -364,7 +364,7 @@ static void connect(struct blkfront_info=0A=
 	}=0A =0A 	err =3D xenbus_gather(XBT_NIL, info->xbdev->otheren=
d,=0A-			    "feature-barrier", "%lu", &info->feature_barrie=
r,=0A+			    "feature-barrier", "%d", &info->feature_barrier=
,=0A 			    NULL);=0A 	if (err)=0A 		info->featu=
re_barrier =3D 0;=0A
--=__PartFAD67E0D.0__=
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

--=__PartFAD67E0D.0__=--