diff mbox

[1/2] block: Fix unaligned zero write

Message ID 1427085970-23823-2-git-send-email-famz@redhat.com
State New
Headers show

Commit Message

Fam Zheng March 23, 2015, 4:46 a.m. UTC 
If the zero write is not aligned, bdrv_co_do_pwritev will segfault
because of accessing to the NULL qiov passed in by bdrv_co_write_zeroes.
Fix this by allocating a local qiov in bdrv_co_do_pwritev if the request
is not aligned. (In this case the padding iovs are necessary anyway, so
it doesn't hurt.)

Also add a check at the end of bdrv_co_do_pwritev to clear the zero flag
if padding is involved.

Signed-off-by: Fam Zheng <famz@redhat.com>
---
 block.c | 51 ++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 9 deletions(-)

Comments

Stefan Hajnoczi March 23, 2015, 2:14 p.m. UTC | #1 
On Mon, Mar 23, 2015 at 12:46:09PM +0800, Fam Zheng wrote:
> @@ -3435,6 +3446,10 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
>          bytes = ROUND_UP(bytes, align);
>      }
>  
> +    if (use_local_qiov) {
> +        /* Local buffer may have non-zero data. */
> +        flags &= ~BDRV_REQ_ZERO_WRITE;
> +    }
>      ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
>                                 use_local_qiov ? &local_qiov : qiov,
>                                 flags);
> @@ -3475,14 +3490,32 @@ int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs,
>                                        int64_t sector_num, int nb_sectors,
>                                        BdrvRequestFlags flags)
>  {
> +    int ret;
> +
>      trace_bdrv_co_write_zeroes(bs, sector_num, nb_sectors, flags);
>  
> -    if (!(bs->open_flags & BDRV_O_UNMAP)) {
> -        flags &= ~BDRV_REQ_MAY_UNMAP;
> -    }

Why is it okay to drop this when the request is aligned?

> +    if (bdrv_req_is_aligned(bs, sector_num << BDRV_SECTOR_BITS,
> +                            nb_sectors << BDRV_SECTOR_BITS)) {
> +        ret = bdrv_co_do_writev(bs, sector_num, nb_sectors, NULL,
> +                                BDRV_REQ_ZERO_WRITE | flags);
> +    } else {
Peter Lieven March 23, 2015, 2:35 p.m. UTC | #2 
Am 23.03.2015 um 15:14 schrieb Stefan Hajnoczi:
> On Mon, Mar 23, 2015 at 12:46:09PM +0800, Fam Zheng wrote:
>> @@ -3435,6 +3446,10 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
>>           bytes = ROUND_UP(bytes, align);
>>       }
>>   
>> +    if (use_local_qiov) {
>> +        /* Local buffer may have non-zero data. */
>> +        flags &= ~BDRV_REQ_ZERO_WRITE;
>> +    }
>>       ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
>>                                  use_local_qiov ? &local_qiov : qiov,
>>                                  flags);
>> @@ -3475,14 +3490,32 @@ int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs,
>>                                         int64_t sector_num, int nb_sectors,
>>                                         BdrvRequestFlags flags)
>>   {
>> +    int ret;
>> +
>>       trace_bdrv_co_write_zeroes(bs, sector_num, nb_sectors, flags);
>>   
>> -    if (!(bs->open_flags & BDRV_O_UNMAP)) {
>> -        flags &= ~BDRV_REQ_MAY_UNMAP;
>> -    }
> Why is it okay to drop this when the request is aligned?

I also think it is not. This is the only point in the code that clears the
MAY_UNMAP flag when we do not open with discard=on

Peter
Fam Zheng March 24, 2015, 1:19 a.m. UTC | #3 
On Mon, 03/23 14:14, Stefan Hajnoczi wrote:
> On Mon, Mar 23, 2015 at 12:46:09PM +0800, Fam Zheng wrote:
> > @@ -3435,6 +3446,10 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
> >          bytes = ROUND_UP(bytes, align);
> >      }
> >  
> > +    if (use_local_qiov) {
> > +        /* Local buffer may have non-zero data. */
> > +        flags &= ~BDRV_REQ_ZERO_WRITE;
> > +    }
> >      ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
> >                                 use_local_qiov ? &local_qiov : qiov,
> >                                 flags);
> > @@ -3475,14 +3490,32 @@ int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs,
> >                                        int64_t sector_num, int nb_sectors,
> >                                        BdrvRequestFlags flags)
> >  {
> > +    int ret;
> > +
> >      trace_bdrv_co_write_zeroes(bs, sector_num, nb_sectors, flags);
> >  
> > -    if (!(bs->open_flags & BDRV_O_UNMAP)) {
> > -        flags &= ~BDRV_REQ_MAY_UNMAP;
> > -    }
> 
> Why is it okay to drop this when the request is aligned?

It's not. I will restore it.

> 
> > +    if (bdrv_req_is_aligned(bs, sector_num << BDRV_SECTOR_BITS,
> > +                            nb_sectors << BDRV_SECTOR_BITS)) {
> > +        ret = bdrv_co_do_writev(bs, sector_num, nb_sectors, NULL,
> > +                                BDRV_REQ_ZERO_WRITE | flags);
> > +    } else {
diff mbox

Patch

diff --git a/block.c b/block.c
index 210fd5f..469b509 100644
--- a/block.c
+++ b/block.c
@@ -3086,6 +3086,19 @@  out:
     return ret;
 }
 
+static inline uint64_t bdrv_get_align(BlockDriverState *bs)
+{
+    /* TODO Lift BDRV_SECTOR_SIZE restriction in BlockDriver interface */
+    return MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
+}
+
+static inline bool bdrv_req_is_aligned(BlockDriverState *bs,
+                                       int64_t offset, size_t bytes)
+{
+    int64_t align = bdrv_get_align(bs);
+    return !(offset & (align - 1) || (bytes & (align - 1)));
+}
+
 /*
  * Handle a read request in coroutine context
  */
@@ -3096,8 +3109,7 @@  static int coroutine_fn bdrv_co_do_preadv(BlockDriverState *bs,
     BlockDriver *drv = bs->drv;
     BdrvTrackedRequest req;
 
-    /* TODO Lift BDRV_SECTOR_SIZE restriction in BlockDriver interface */
-    uint64_t align = MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
+    uint64_t align = bdrv_get_align(bs);
     uint8_t *head_buf = NULL;
     uint8_t *tail_buf = NULL;
     QEMUIOVector local_qiov;
@@ -3337,8 +3349,7 @@  static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
     BdrvRequestFlags flags)
 {
     BdrvTrackedRequest req;
-    /* TODO Lift BDRV_SECTOR_SIZE restriction in BlockDriver interface */
-    uint64_t align = MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
+    uint64_t align = bdrv_get_align(bs);
     uint8_t *head_buf = NULL;
     uint8_t *tail_buf = NULL;
     QEMUIOVector local_qiov;
@@ -3435,6 +3446,10 @@  static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
         bytes = ROUND_UP(bytes, align);
     }
 
+    if (use_local_qiov) {
+        /* Local buffer may have non-zero data. */
+        flags &= ~BDRV_REQ_ZERO_WRITE;
+    }
     ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
                                use_local_qiov ? &local_qiov : qiov,
                                flags);
@@ -3475,14 +3490,32 @@  int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs,
                                       int64_t sector_num, int nb_sectors,
                                       BdrvRequestFlags flags)
 {
+    int ret;
+
     trace_bdrv_co_write_zeroes(bs, sector_num, nb_sectors, flags);
 
-    if (!(bs->open_flags & BDRV_O_UNMAP)) {
-        flags &= ~BDRV_REQ_MAY_UNMAP;
-    }
+    if (bdrv_req_is_aligned(bs, sector_num << BDRV_SECTOR_BITS,
+                            nb_sectors << BDRV_SECTOR_BITS)) {
+        ret = bdrv_co_do_writev(bs, sector_num, nb_sectors, NULL,
+                                BDRV_REQ_ZERO_WRITE | flags);
+    } else {
+        uint8_t *buf;
+        QEMUIOVector local_qiov;
+        size_t bytes = nb_sectors << BDRV_SECTOR_BITS;
+
+        buf = qemu_memalign(bdrv_opt_mem_align(bs), bytes);
+        memset(buf, 0, bytes);
+        qemu_iovec_init(&local_qiov, 1);
+        qemu_iovec_add(&local_qiov, buf, bytes);
+        if (!(bs->open_flags & BDRV_O_UNMAP)) {
+            flags &= ~BDRV_REQ_MAY_UNMAP;
+        }
 
-    return bdrv_co_do_writev(bs, sector_num, nb_sectors, NULL,
-                             BDRV_REQ_ZERO_WRITE | flags);
+        ret = bdrv_co_do_writev(bs, sector_num, nb_sectors, &local_qiov,
+                                BDRV_REQ_ZERO_WRITE | flags);
+        qemu_vfree(buf);
+    }
+    return ret;
 }
 
 /**