[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [XTF] xenbus: fix xenbus_write() ring overflow


  • To: Pawel Wieczorkiewicz <wipawel@xxxxxxxxx>, <xen-devel@xxxxxxxxxxxxx>
  • From: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
  • Date: Wed, 3 Jun 2020 21:46:12 +0100
  • Authentication-results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none
  • Cc: julien@xxxxxxx, wipawel@xxxxxxx
  • Delivery-date: Wed, 03 Jun 2020 20:46:31 +0000
  • Ironport-sdr: ZEa2eF+s/eaIrs3thAnFPIjtP2GgNPrHpZ2geRiHgP3i9ORY3LjT0Z1DZdhMB0Bs0xLKnfEAyA DurC/XM+xhBC+/tT7TNx1/o24bs/hu+kMh1VEor0x9YW30LQJ4kHvRGA8bof/xkcsdZb18Bjxo SH06ymt2caW+StrAiNPbNJH/3zZ4ftdh9tk152jO6F/IJWi03fQUNNZ2+Fm/L/yhk0y3+C3E99 qP7oB33MvEE8kLeNxsd/bmawkZG1Ml+vARc4YBIpElE4XG6H5NidHlt7Tvo36K+RkLyKoqM6f5 NTo=
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

On 03/06/2020 09:21, Pawel Wieczorkiewicz wrote:
> Currently the xenbus_write() does not handle ring wrapping around
> correctly. When ring buffer is almost full and there is not enough
> space for next packet (e.g. there is 12 bytes of space left, but the
> packet header needs to transmit 16 bytes) the memcpy() goes out of the
> ring buffer boundry.
> Instead, the part variable should be limited to the space available in
> the ring buffer, so the memcpy() can fill up the buffer, update len
> variable (to indicate that there is still some data to be copied) and
> thereby the xenbus_write() loop can iterate again to finish copying
> the remainder of data to the beginning of the ring buffer.
>
> Signed-off-by: Pawel Wieczorkiewicz <wipawel@xxxxxxxxx>

Oops.  Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> and pushed.



 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.