| Message ID | 1340024457-27306-1-git-send-email-stefanha@linux.vnet.ibm.com |
|---|---|
| State | New |
| Headers | show |
Am 18.06.2012 15:00, schrieb Stefan Hajnoczi: > When qcow2_alloc_clusters() error handling code was introduced in commit > 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset > was clobbered in the error case. This patch keeps free_byte_offset at 0 > so we will try to allocate clusters again next time this function is > called. > > Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Thanks, applied to the block branch. And I guess we should get test case 026 fixed up and extended to cover this. Kevin
On Mon, Jun 18, 2012 at 2:11 PM, Kevin Wolf <kwolf@redhat.com> wrote: > Am 18.06.2012 15:00, schrieb Stefan Hajnoczi: >> When qcow2_alloc_clusters() error handling code was introduced in commit >> 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset >> was clobbered in the error case. This patch keeps free_byte_offset at 0 >> so we will try to allocate clusters again next time this function is >> called. >> >> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> > > Thanks, applied to the block branch. > > And I guess we should get test case 026 fixed up and extended to cover this. I'm not sure what to test. It already returned the error code correctly. The problem was what happened when called again - there would be junk in free_byte_offset. Stefan
Am 18.06.2012 15:16, schrieb Stefan Hajnoczi: > On Mon, Jun 18, 2012 at 2:11 PM, Kevin Wolf <kwolf@redhat.com> wrote: >> Am 18.06.2012 15:00, schrieb Stefan Hajnoczi: >>> When qcow2_alloc_clusters() error handling code was introduced in commit >>> 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset >>> was clobbered in the error case. This patch keeps free_byte_offset at 0 >>> so we will try to allocate clusters again next time this function is >>> called. >>> >>> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> >> >> Thanks, applied to the block branch. >> >> And I guess we should get test case 026 fixed up and extended to cover this. > > I'm not sure what to test. It already returned the error code > correctly. The problem was what happened when called again - there > would be junk in free_byte_offset. Then this is what needs to be tested. For example: 1. Configure blkdebug to fail on BLKDBG_CLUSTER_ALLOC_BYTES once 2. write_compressed() fails with the configured errno, s->cluster_size is corrupted in the old version. 3. write_compressed() is expected to succeed. The buggy version may succeed as well, or fail somewhere else because of the negative (or wrapped around, huge) offset. There are different ways to check if we wrote to the right offset, probably the best way is to combine them: 4a. The obvious one: Read the data back. May or may not reveal a bug, depending on what the read code does with negative offsets. 4b. qemu-img info. The image file size is an indicator for this bug. 4c. Repeat the same procedure with a different cluster and a different pattern. Read back both. If the second one has overwritten the first one, there is a problem. Kevin
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 812c93c..2d5420c 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -627,10 +627,11 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size) BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES); assert(size > 0 && size <= s->cluster_size); if (s->free_byte_offset == 0) { - s->free_byte_offset = qcow2_alloc_clusters(bs, s->cluster_size); - if (s->free_byte_offset < 0) { - return s->free_byte_offset; + offset = qcow2_alloc_clusters(bs, s->cluster_size); + if (offset < 0) { + return offset; } + s->free_byte_offset = offset; } redo: free_in_cluster = s->cluster_size -
When qcow2_alloc_clusters() error handling code was introduced in commit 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset was clobbered in the error case. This patch keeps free_byte_offset at 0 so we will try to allocate clusters again next time this function is called. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> --- block/qcow2-refcount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)