Function do_io() in arch/um/drivers/ubd_kern.c can read uninitialized memory
when scanning the .sector_mask. During startup the maximum .length
is 64K (and has been observed), so 128 bits are needed [512-byte sectors.]
Initialized .sector_mask has 32 bits, and initialized .cow_offset has 64,
so 32 bits must come from .bitmap_words[0]; but .bitmap_words is not
initialized by prepare_request().
If .fds[0]==.fds[1], as it is in early startup, then the net effect
of scanning the uninit .bitmap_words[0] is "merely" a randomness and
possible slowdown in I/O operations, which is better to avoid anyway.
Either call blk_queue_max_sectors() much earlier (and always) in order
to restrict all transfers to at most 32 [or 96] sectors, else apply
the attached patch to clear .bitmap_words[0].
--
John Reiser, [EMAIL PROTECTED]
--- linux-2.6.23/arch/um/drivers/ubd_kern.c 2007-12-04 14:49:28.000000000 -0800
+++ new/arch/um/drivers/ubd_kern.c 2007-12-04 14:55:32.000000000 -0800
@@ -1069,6 +1069,12 @@
io_req->length = len;
io_req->error = 0;
io_req->sector_mask = 0;
+/* At startup, the maximum .length is 64K, and blk_queue_max_sectors()
+ * has not been called yet. So do_io() could require 64K/(1<<9) = 128 bits:
+ * 32 in sector_mask, 64 in cow_offset, 32 in bitmap_words[0].
+ * 2007-12-04 jreiser (valgrind/memcheck)
+ */
+ io_req->bitmap_words[0] = 0;
io_req->op = (rq_data_dir(req) == READ) ? UBD_READ : UBD_WRITE;
io_req->offsets[0] = 0;
-------------------------------------------------------------------------
SF.Net email is sponsored by: The Future of Linux Business White Paper
from Novell. From the desktop to the data center, Linux is going
mainstream. Let it simplify your IT future.
http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4
_______________________________________________
User-mode-linux-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
