[Xen-changelog] [linux-2.6.18-xen] usbback: correct copy length for partial transfers

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User Juergen Gross <jgross@xxxxxxxx>
# Date 1443429534 -7200
# Node ID 47161cb7bd45c059b8e75c09d59ee1124953ad46
# Parent  b4bb467e5c077745957e26ea6872cfc65e87e4c2
usbback: correct copy length for partial transfers

Commit 72387b3c2252 ("usbback: copy only filled buffers to guest") has
introduced an error leading to copying the wrong amount of data to the
guest in case of read I/Os with not the complete buffer filled.

Depending on the amount of data read either too much or not enough
data was copied: if a buffer segment was filled less than half still
some data of the backend kernel could leak into the guest, while a
buffer segment filled more than half of it's size wouldn't be copied
completely.

Correct this by limiting the to be copied data amount to the rest
length of the read data.

Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
Committed-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r b4bb467e5c07 -r 47161cb7bd45 drivers/xen/usbback/usbback.c
--- a/drivers/xen/usbback/usbback.c     Wed Sep 09 09:52:22 2015 +0200
+++ b/drivers/xen/usbback/usbback.c     Mon Sep 28 10:38:54 2015 +0200
@@ -213,7 +213,7 @@ static void copy_buff_to_pages(void *buf
                                buf_off += offset - buf_off;
                        }
                        if (buf_off + len > offset + length)
-                               len -= offset + length - buf_off;
+                               len = offset + length - buf_off;
                        memcpy((void *)vaddr(pending_req, i) + off,
                               buff + buf_off, len);
                }

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog