Blame SOURCES/kvm-block-Fix-NULL-deference-for-unaligned-write-if-qiov.patch

05bba0
From 22db646a6d358e08c4c11f12e3dcf96f25525bf8 Mon Sep 17 00:00:00 2001
05bba0
From: Fam Zheng <famz@redhat.com>
05bba0
Date: Mon, 25 May 2015 04:45:56 +0200
05bba0
Subject: [PATCH 4/6] block: Fix NULL deference for unaligned write if qiov is
05bba0
 NULL
05bba0
05bba0
Message-id: <1432529157-20381-3-git-send-email-famz@redhat.com>
05bba0
Patchwork-id: 65120
05bba0
O-Subject: [RHEL-7.2 qemu-kvm PATCH v2 2/3] block: Fix NULL deference for unaligned write if qiov is NULL
05bba0
Bugzilla: 1200295
05bba0
RH-Acked-by: Max Reitz <mreitz@redhat.com>
05bba0
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
05bba0
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
05bba0
05bba0
For zero write, callers pass in NULL qiov (qemu-io "write -z" or
05bba0
scsi-disk "write same").
05bba0
05bba0
Commit fc3959e466 fixed bdrv_co_write_zeroes which is the common case
05bba0
for this bug, but it still exists in bdrv_aio_write_zeroes. A simpler
05bba0
fix would be in bdrv_co_do_pwritev which is the NULL dereference point
05bba0
and covers both cases.
05bba0
05bba0
So don't access it in bdrv_co_do_pwritev in this case, use three aligned
05bba0
writes.
05bba0
05bba0
[Initialize ret to 0 in bdrv_co_do_zero_pwritev() to avoid uninitialized
05bba0
variable warning with gcc 4.9.2.
05bba0
--Stefan]
05bba0
05bba0
Signed-off-by: Fam Zheng <famz@redhat.com>
05bba0
Message-id: 1431522721-3266-3-git-send-email-famz@redhat.com
05bba0
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
05bba0
(cherry picked from commit 9eeb6dd1b27bd57eb4e3869290e87feac8e8b226)
05bba0
05bba0
We don't have block/io.c in downstream, applied the change to
05bba0
block.c
05bba0
05bba0
Signed-off-by: Fam Zheng <famz@redhat.com>
05bba0
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
05bba0
---
05bba0
 block.c | 97 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
05bba0
 1 file changed, 95 insertions(+), 2 deletions(-)
05bba0
05bba0
diff --git a/block.c b/block.c
05bba0
index 89ab829..45543d5 100644
05bba0
--- a/block.c
05bba0
+++ b/block.c
05bba0
@@ -3069,6 +3069,94 @@ static int coroutine_fn bdrv_aligned_pwritev(BlockDriverState *bs,
05bba0
     return ret;
05bba0
 }
05bba0
 
05bba0
+static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
05bba0
+                                                int64_t offset,
05bba0
+                                                unsigned int bytes,
05bba0
+                                                BdrvRequestFlags flags,
05bba0
+                                                BdrvTrackedRequest *req)
05bba0
+{
05bba0
+    uint8_t *buf = NULL;
05bba0
+    QEMUIOVector local_qiov;
05bba0
+    struct iovec iov;
05bba0
+    uint64_t align = MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
05bba0
+    unsigned int head_padding_bytes, tail_padding_bytes;
05bba0
+    int ret = 0;
05bba0
+
05bba0
+    head_padding_bytes = offset & (align - 1);
05bba0
+    tail_padding_bytes = align - ((offset + bytes) & (align - 1));
05bba0
+
05bba0
+
05bba0
+    assert(flags & BDRV_REQ_ZERO_WRITE);
05bba0
+    if (head_padding_bytes || tail_padding_bytes) {
05bba0
+        buf = qemu_blockalign(bs, align);
05bba0
+        iov = (struct iovec) {
05bba0
+            .iov_base   = buf,
05bba0
+            .iov_len    = align,
05bba0
+        };
05bba0
+        qemu_iovec_init_external(&local_qiov, &iov, 1);
05bba0
+    }
05bba0
+    if (head_padding_bytes) {
05bba0
+        uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
05bba0
+
05bba0
+        /* RMW the unaligned part before head. */
05bba0
+        mark_request_serialising(req, align);
05bba0
+        wait_serialising_requests(req);
05bba0
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_HEAD);
05bba0
+        ret = bdrv_aligned_preadv(bs, req, offset & ~(align - 1), align,
05bba0
+                                  align, &local_qiov, 0);
05bba0
+        if (ret < 0) {
05bba0
+            goto fail;
05bba0
+        }
05bba0
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
05bba0
+
05bba0
+        memset(buf + head_padding_bytes, 0, zero_bytes);
05bba0
+        ret = bdrv_aligned_pwritev(bs, req, offset & ~(align - 1), align,
05bba0
+                                   &local_qiov,
05bba0
+                                   flags & ~BDRV_REQ_ZERO_WRITE);
05bba0
+        if (ret < 0) {
05bba0
+            goto fail;
05bba0
+        }
05bba0
+        offset += zero_bytes;
05bba0
+        bytes -= zero_bytes;
05bba0
+    }
05bba0
+
05bba0
+    assert(!bytes || (offset & (align - 1)) == 0);
05bba0
+    if (bytes >= align) {
05bba0
+        /* Write the aligned part in the middle. */
05bba0
+        uint64_t aligned_bytes = bytes & ~(align - 1);
05bba0
+        ret = bdrv_aligned_pwritev(bs, req, offset, aligned_bytes,
05bba0
+                                   NULL, flags);
05bba0
+        if (ret < 0) {
05bba0
+            goto fail;
05bba0
+        }
05bba0
+        bytes -= aligned_bytes;
05bba0
+        offset += aligned_bytes;
05bba0
+    }
05bba0
+
05bba0
+    assert(!bytes || (offset & (align - 1)) == 0);
05bba0
+    if (bytes) {
05bba0
+        assert(align == tail_padding_bytes + bytes);
05bba0
+        /* RMW the unaligned part after tail. */
05bba0
+        mark_request_serialising(req, align);
05bba0
+        wait_serialising_requests(req);
05bba0
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_TAIL);
05bba0
+        ret = bdrv_aligned_preadv(bs, req, offset, align,
05bba0
+                                  align, &local_qiov, 0);
05bba0
+        if (ret < 0) {
05bba0
+            goto fail;
05bba0
+        }
05bba0
+        BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
05bba0
+
05bba0
+        memset(buf, 0, bytes);
05bba0
+        ret = bdrv_aligned_pwritev(bs, req, offset, align,
05bba0
+                                   &local_qiov, flags & ~BDRV_REQ_ZERO_WRITE);
05bba0
+    }
05bba0
+fail:
05bba0
+    qemu_vfree(buf);
05bba0
+    return ret;
05bba0
+
05bba0
+}
05bba0
+
05bba0
 /*
05bba0
  * Handle a write request in coroutine context
05bba0
  */
05bba0
@@ -3108,6 +3196,11 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
05bba0
      */
05bba0
     tracked_request_begin(&req, bs, offset, bytes, true);
05bba0
 
05bba0
+    if (!qiov) {
05bba0
+        ret = bdrv_co_do_zero_pwritev(bs, offset, bytes, flags, &req;;
05bba0
+        goto out;
05bba0
+    }
05bba0
+
05bba0
     if (offset & (align - 1)) {
05bba0
         QEMUIOVector head_qiov;
05bba0
         struct iovec head_iov;
05bba0
@@ -3181,14 +3274,14 @@ static int coroutine_fn bdrv_co_do_pwritev(BlockDriverState *bs,
05bba0
                                flags);
05bba0
 
05bba0
 fail:
05bba0
-    tracked_request_end(&req;;
05bba0
 
05bba0
     if (use_local_qiov) {
05bba0
         qemu_iovec_destroy(&local_qiov);
05bba0
     }
05bba0
     qemu_vfree(head_buf);
05bba0
     qemu_vfree(tail_buf);
05bba0
-
05bba0
+out:
05bba0
+    tracked_request_end(&req;;
05bba0
     return ret;
05bba0
 }
05bba0
 
05bba0
-- 
05bba0
1.8.3.1
05bba0