xen/blkback: Copy id field when doing BLKIF_DISCARD.
authorKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Fri, 25 May 2012 20:11:09 +0000 (16:11 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 16 Jul 2012 16:04:08 +0000 (09:04 -0700)
commit8c890e34f58fc8d3c0eafecf0bdc92c4161b1679
treefd845d3c52c52c045f70624c8529a8d55e391f34
parent0341705f37081a337d6c073d326e4e9ad2ddcc83
xen/blkback: Copy id field when doing BLKIF_DISCARD.

commit 8c9ce606a60e4a0cb447bdc082ce383b96b227b4 upstream.

We weren't copying the id field so when we sent the response
back to the frontend (especially with a 64-bit host and 32-bit
guest), we ended up using a random value. This lead to the
frontend crashing as it would try to pass to __blk_end_request_all
a NULL 'struct request' (b/c it would use the 'id' to find the
proper 'struct request' in its shadow array) and end up crashing:

BUG: unable to handle kernel NULL pointer dereference at 000000e4
IP: [<c0646d4c>] __blk_end_request_all+0xc/0x40
.. snip..
EIP is at __blk_end_request_all+0xc/0x40
.. snip..
 [<ed95db72>] blkif_interrupt+0x172/0x330 [xen_blkfront]

This fixes the bug by passing in the proper id for the response.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=824641

Tested-by: William Dauchy <wdauchy@gmail.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/xen-blkback/common.h