Subject: xen/blkback: don't fail empty barrier requests The sector number on empty barrier requests may (will?) be uninitialized (neither bio_init() nor rq_init() set the respective fields), which allows for exceeding the actual (virtual) disk's size. Inspired by Konrad's "When writting barriers set the sector number to zero...", but instead of zapping the sector number (which is wrong for non-empty ones) just ignore the sector number when the sector count is zero. While at it also add overflow checking to the math in vbd_translate(). Signed-off-by: Jan Beulich Cc: Konrad Rzeszutek Wilk --- a/drivers/xen/blkback/vbd.c +++ b/drivers/xen/blkback/vbd.c @@ -108,8 +108,14 @@ int vbd_translate(struct phys_req *req, if ((operation != READ) && vbd->readonly) goto out; - if (unlikely((req->sector_number + req->nr_sects) > vbd_sz(vbd))) - goto out; + if (likely(req->nr_sects)) { + blkif_sector_t end = req->sector_number + req->nr_sects; + + if (unlikely(end < req->sector_number)) + goto out; + if (unlikely(end > vbd_sz(vbd))) + goto out; + } req->dev = vbd->pdevice; req->bdev = vbd->bdev;