svn commit: r287875 - head/sys/cam/ctl

[Alexander Motin]

Author: mav
Date: Wed Sep 16 21:43:51 2015
New Revision: 287875
URL: https://svnweb.freebsd.org/changeset/base/287875

Log:
  Fix reading after end of file for file-backed LUNs.
  
  If backing file is smaller then the LUN size, we have to explicitly clear
  the rest of the buffer to not leak some random data from previous I/Os.

Modified:
  head/sys/cam/ctl/ctl_backend_block.c

Modified: head/sys/cam/ctl/ctl_backend_block.c
==============================================================================
--- head/sys/cam/ctl/ctl_backend_block.c	Wed Sep 16 21:42:33 2015	(r287874)
+++ head/sys/cam/ctl/ctl_backend_block.c	Wed Sep 16 21:43:51 2015	(r287875)
@@ -632,8 +632,8 @@ ctl_be_block_dispatch_file(struct ctl_be
 	union ctl_io *io;
 	struct uio xuio;
 	struct iovec *xiovec;
-	int flags;
-	int error, i;
+	size_t s;
+	int error, flags, i;
 
 	DPRINTF("entered\n");
 
@@ -694,6 +694,22 @@ ctl_be_block_dispatch_file(struct ctl_be
 
 		VOP_UNLOCK(be_lun->vn, 0);
 		SDT_PROBE(cbb, kernel, read, file_done, 0, 0, 0, 0, 0);
+		if (error == 0 && xuio.uio_resid > 0) {
+			/*
+			 * If we red less then requested (EOF), then
+			 * we should clean the rest of the buffer.
+			 */
+			s = beio->io_len - xuio.uio_resid;
+			for (i = 0; i < beio->num_segs; i++) {
+				if (s >= beio->sg_segs[i].len) {
+					s -= beio->sg_segs[i].len;
+					continue;
+				}
+				bzero((uint8_t *)beio->sg_segs[i].addr + s,
+				    beio->sg_segs[i].len - s);
+				s = 0;
+			}
+		}
 	} else {
 		struct mount *mountpoint;
 		int lock_flags;