|
 |
3cdd4c |
From f58d2a04338edc647e2334ff58b49508424e3f3b Mon Sep 17 00:00:00 2001
|
|
|
3cdd4c |
From: "Richard W.M. Jones" <rjones@redhat.com>
|
|
|
3cdd4c |
Date: Tue, 17 May 2022 13:20:17 +0100
|
|
|
3cdd4c |
Subject: [PATCH] scan: Fix bound so we don't try to prefetch beyond end of
|
|
|
3cdd4c |
disk
|
|
|
3cdd4c |
|
|
|
3cdd4c |
An off-by-one error in the bound could cause the filter to try to
|
|
|
3cdd4c |
prefetch beyond the end of the underlying plugin. This would cause
|
|
|
3cdd4c |
nbdkit to crash with this assertion failure:
|
|
|
3cdd4c |
|
|
|
3cdd4c |
nbdkit: backend.c:782: backend_cache: Assertion `backend_valid_range (c, offset, count)' failed.
|
|
|
3cdd4c |
|
|
|
3cdd4c |
The sequence of events was:
|
|
|
3cdd4c |
|
|
|
3cdd4c |
- scan filter background thread started
|
|
|
3cdd4c |
|
|
|
3cdd4c |
- client reads to the end of the disk
|
|
|
3cdd4c |
|
|
|
3cdd4c |
- background thread skips ahead to end of disk (offset == size)
|
|
|
3cdd4c |
|
|
|
3cdd4c |
- background thread tries to prefetch from this point
|
|
|
3cdd4c |
|
|
|
3cdd4c |
In the final step the calculations caused to the background thread to
|
|
|
3cdd4c |
prefetch a scan-size block beyond the end of the plugin.
|
|
|
3cdd4c |
|
|
|
3cdd4c |
Fixes: commit 65c20a09ceacb4431986a2982f2c2e746df63fcb
|
|
|
3cdd4c |
(cherry picked from commit 953643429b8c57b4dd20a6c0e5b83704ae9a0e88)
|
|
|
3cdd4c |
---
|
|
|
3cdd4c |
filters/scan/bgthread.c | 10 +++++-----
|
|
|
3cdd4c |
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
3cdd4c |
|
|
|
3cdd4c |
diff --git a/filters/scan/bgthread.c b/filters/scan/bgthread.c
|
|
|
3cdd4c |
index 384e79b6..5fa5f27f 100644
|
|
|
3cdd4c |
--- a/filters/scan/bgthread.c
|
|
|
3cdd4c |
+++ b/filters/scan/bgthread.c
|
|
|
3cdd4c |
@@ -113,12 +113,12 @@ scan_thread (void *vp)
|
|
|
3cdd4c |
}
|
|
|
3cdd4c |
|
|
|
3cdd4c |
adjust_clock (offset);
|
|
|
3cdd4c |
- if (offset > size)
|
|
|
3cdd4c |
- continue;
|
|
|
3cdd4c |
|
|
|
3cdd4c |
- /* Issue the next prefetch. */
|
|
|
3cdd4c |
- n = MIN (scan_size, size - offset);
|
|
|
3cdd4c |
- ctrl->next->cache (ctrl->next, n, offset, 0, NULL);
|
|
|
3cdd4c |
+ if (offset < size) {
|
|
|
3cdd4c |
+ /* Issue the next prefetch. */
|
|
|
3cdd4c |
+ n = MIN (scan_size, size - offset);
|
|
|
3cdd4c |
+ ctrl->next->cache (ctrl->next, n, offset, 0, NULL);
|
|
|
3cdd4c |
+ }
|
|
|
3cdd4c |
}
|
|
|
3cdd4c |
|
|
|
3cdd4c |
if (scan_forever) {
|
|
|
3cdd4c |
--
|
|
|
3cdd4c |
2.31.1
|
|
|
3cdd4c |
|