src/tapset ChangeLog nfs.stp

[Wenji Huang]

Stone,

    Yes, It is more safe to duplicate this function with kread.
    It returns same result as kernel iov_length. And in case of bad 
pointer/nr_segs, there is kernel read fault error.
    Please review it.

    function __iov_length:long(iov:long, nr_segs:long) %{ /*pure*/
        unsigned long seg;
        size_t ret = 0;
        const struct iovec *iov = (const struct iovec *) (long) THIS->iov;
        unsigned long nr_segs = (unsigned long) THIS->nr_segs;

        for (seg = 0; seg < nr_segs; seg++)
                ret += kread(&(iov[seg].iov_len));

        THIS->__retvalue = (long) ret;
        CATCH_DEREF_FAULT();
    %}

Thanks,
Wenji,

Stone, Joshua I wrote:

>wenji@sourceware.org wrote:
>  
>
>>CVSROOT:	/cvs/systemtap
>>Module name:	src
>>Changes by:	wenji@sourceware.org	2007-08-20 08:12:00
>>
>>Modified files:
>>	tapset         : ChangeLog nfs.stp
>>
>>Log message:
>>	2007-08-20  Wenji Huang  <wenji.huang@oracle.com>
>>	
>>	* nfs.stp (nfs.fop.aio_read, nfs.fop.aio_write): Modify
>>    
>>
>evaluating count.
>  
>
>>	(__iov_length): New function.
>>	(nfs.fop.sendfile, nfs.aop.set_page_dirty,
>>    
>>
>nfs.aop.prepare_write,
>  
>
>>	nfs.aop.release_page): Fix typo.
>>    
>>
>
>The new __iov_length() should not trust its parameters.  If it's ever
>called with a bad pointer or bad nr_segs, the call to kernel
>iov_length() will cause a system crash.
>
>The only safe way to handle this is to duplicate the functionality of
>iov_length() with our own code that uses kread().  Thankfully it is a
>small function in this case.
>
>Josh
>
>  
>