2006-08-15 Thang Nguyen <thang.p.nguyen@intel.com>

	* ioblock.stp:  Added safety checks for __bio_ino() and
	__bio_start_sect().

1 files changed, 55 insertions, 15 deletions

diff --git a/tapset/ioblock.stp b/tapset/ioblock.stp
index 65e0dd8b..3590f750 100644
--- a/tapset/ioblock.stp
+++ b/tapset/ioblock.stp
@@ -15,16 +15,37 @@
 /* get i-node number of mapped file */
 function __bio_ino:long(bio:long)
 %{
-        struct bio *bio = (struct bio *)(long)THIS->bio;
-        if ((bio->bi_io_vec[0].bv_page  == NULL) ||
-                (bio->bi_io_vec[0].bv_page->mapping == NULL))
-                THIS->__retvalue = -1;
-        else
-                THIS->__retvalue = bio->bi_io_vec[0].bv_page->mapping->host->i_ino;
+        struct bio  *bio;
+        struct page *bv_page;
+        struct address_space *mapping;
+        struct inode *host;
+
+	bio = (struct bio *)(long)THIS->bio;
+        bv_page = (struct page*)deref(sizeof(bio->bi_io_vec[0].bv_page),
+        	&(bio->bi_io_vec[0].bv_page));
+        if (bv_page == NULL) {
+        	THIS->__retvalue = -1;
+        	goto end;
+        }
+        mapping = (struct address_space*)deref(sizeof(bv_page->mapping),
+        	&(bv_page->mapping));
+        if (mapping == NULL) {
+        	THIS->__retvalue = -1;
+        	goto end;
+        }
+        host = (struct inode*)deref(sizeof(mapping->host),
+        	&(mapping->host));
+        if (host == NULL) {
+        	THIS->__retvalue = -1;
+        	goto end;
+        }
+        THIS->__retvalue = deref(sizeof(host->i_ino), &(host->i_ino));
+
         if (0) {
 deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
+        	CONTEXT->last_error = "pointer dereference fault";
         }
+end: ;
 %}
 
 /* returns 0 for read, 1 for write */
@@ -42,17 +63,38 @@ function bio_rw_str(rw)
 
 /* returns start sector */
 function __bio_start_sect:long(bio:long)
-%{
-        struct bio *bio = (struct bio *)(long)THIS->bio;
-        if ((bio == NULL) || (bio->bi_bdev == NULL) ||
-            	(bio->bi_bdev->bd_part == NULL))
+%{ 
+	struct bio *bio;
+        struct block_device *bi_bdev;
+        struct hd_struct *bd_part;
+
+	bio = (struct bio *)(long)THIS->bio;
+        bi_bdev = (struct block_device *)deref(sizeof(bio->bi_bdev), 
+		&(bio->bi_bdev));
+        if (bi_bdev == NULL) {
+        	THIS->__retvalue = -1;
+		goto end;
+        } 
+        bd_part = (struct hd_struct *)deref(sizeof(bi_bdev->bd_part),
+		 &(bi_bdev->bd_part));
+        if (bd_part == NULL) {
         	THIS->__retvalue = -1;
-        else 
-        	THIS->__retvalue = bio->bi_bdev->bd_part->start_sect; 
+		goto end;
+        }
+
+       /*
+          There is a bug in deref() that prevents the code below. 
+          THIS->__retvalue = deref(sizeof(bd_part->start_sect), 
+		&(bd_part->start_sect));
+       */
+
+       THIS->__retvalue = bd_part->start_sect;
+
        if (0) {
 deref_fault:
        		CONTEXT->last_error = "pointer dereference fault";
        } 
+end: ;
 %}
 
 /* returns the block device name */
@@ -99,7 +141,6 @@ probe begin
  *  	BIO_USER_MAPPED 6       contains user pages
  *  	BIO_EOPNOTSUPP  7       not supported
  *  
- *  rw_str    - read/write request
  *  rw        - binary trace for read/write request
  *  vcnt      - bio vector count which represents number of array element (page, 
  *              offset, length) which make up this I/O request
@@ -156,7 +197,6 @@ probe ioblock.request = kernel.function ("generic_make_request")
  *      BIO_USER_MAPPED 6       contains user pages
  *      BIO_EOPNOTSUPP  7       not supported
  *  error     - 0 on success
- *  rw_str    - read/write request
  *  rw        - binary trace for read/write request 
  *  vcnt      - bio vector count which represents number of array element (page,
  *              offset, length) which makes up this I/O request