Re: src/tapset ChangeLog nfs.stp

[Wenji Huang <wenji dot huang at oracle dot com>]

Stone,

   Yes, It is more safe to duplicate this function with kread.
   It returns same result as kernel iov_length. And in case of bad 
pointer/nr_segs, there is kernel read fault error.
   Please review it.

   function __iov_length:long(iov:long, nr_segs:long) %{ /*pure*/
       unsigned long seg;
       size_t ret = 0;
       const struct iovec *iov = (const struct iovec *) (long) THIS->iov;
       unsigned long nr_segs = (unsigned long) THIS->nr_segs;

       for (seg = 0; seg < nr_segs; seg++)
               ret += kread(&(iov[seg].iov_len));

       THIS->__retvalue = (long) ret;
       CATCH_DEREF_FAULT();
   %}

Thanks,
Wenji,

Stone, Joshua I wrote:

> wenji@sourceware.org wrote:
>  
>
> > CVSROOT:	/cvs/systemtap
> > Module name:	src
> > Changes by:	wenji@sourceware.org	2007-08-20 08:12:00
> >
> > Modified files:
> > 	tapset         : ChangeLog nfs.stp
> >
> > Log message:
> > 	2007-08-20  Wenji Huang  <wenji.huang@oracle.com>
> > 	
> > 	* nfs.stp (nfs.fop.aio_read, nfs.fop.aio_write): Modify
> >    
> evaluating count.
>  
>
> > 	(__iov_length): New function.
> > 	(nfs.fop.sendfile, nfs.aop.set_page_dirty,
> >    
> nfs.aop.prepare_write,
>  
>
> > 	nfs.aop.release_page): Fix typo.
> >    
>
> The new __iov_length() should not trust its parameters.  If it's ever
> called with a bad pointer or bad nr_segs, the call to kernel
> iov_length() will cause a system crash.
>
> The only safe way to handle this is to duplicate the functionality of
> iov_length() with our own code that uses kread().  Thankfully it is a
> small function in this case.
>
> Josh
>
>