218e99
From 712a6ef0d0d3bbc91953305ad8e7e96f82f19cf0 Mon Sep 17 00:00:00 2001
218e99
From: Max Reitz <mreitz@redhat.com>
218e99
Date: Mon, 4 Nov 2013 22:32:27 +0100
218e99
Subject: [PATCH 34/87] qcow2: Use pread for inactive L1 in overlap check
218e99
218e99
RH-Author: Max Reitz <mreitz@redhat.com>
218e99
Message-id: <1383604354-12743-37-git-send-email-mreitz@redhat.com>
218e99
Patchwork-id: 55336
218e99
O-Subject: [RHEL-7.0 qemu-kvm PATCH 36/43] qcow2: Use pread for inactive L1 in overlap check
218e99
Bugzilla: 1004347
218e99
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
218e99
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
218e99
RH-Acked-by: Fam Zheng <famz@redhat.com>
218e99
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
218e99
218e99
BZ: 1004347
218e99
218e99
Currently, qcow2_check_metadata_overlap uses bdrv_read to read inactive
218e99
L1 tables from disk. The number of sectors to read is calculated through
218e99
a truncating integer division, therefore, if the L1 table size is not a
218e99
multiple of the sector size, the final entries will not be read and
218e99
their entries in memory remain undefined (from the g_malloc).
218e99
Using bdrv_pread fixes this.
218e99
218e99
Signed-off-by: Max Reitz <mreitz@redhat.com>
218e99
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
218e99
(cherry picked from commit 998b959c1e59044f5d5f64c482f4ce8facc8e0bc)
218e99
218e99
Signed-off-by: Max Reitz <mreitz@redhat.com>
218e99
---
218e99
 block/qcow2-refcount.c | 7 +++----
218e99
 1 file changed, 3 insertions(+), 4 deletions(-)
218e99
218e99
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
218e99
---
218e99
 block/qcow2-refcount.c |    7 +++----
218e99
 1 files changed, 3 insertions(+), 4 deletions(-)
218e99
218e99
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
218e99
index 34fcf2f..5c5683d 100644
218e99
--- a/block/qcow2-refcount.c
218e99
+++ b/block/qcow2-refcount.c
218e99
@@ -1701,12 +1701,11 @@ int qcow2_check_metadata_overlap(BlockDriverState *bs, int chk, int64_t offset,
218e99
         for (i = 0; i < s->nb_snapshots; i++) {
218e99
             uint64_t l1_ofs = s->snapshots[i].l1_table_offset;
218e99
             uint32_t l1_sz  = s->snapshots[i].l1_size;
218e99
-            uint64_t *l1 = g_malloc(l1_sz * sizeof(uint64_t));
218e99
+            uint64_t l1_sz2 = l1_sz * sizeof(uint64_t);
218e99
+            uint64_t *l1 = g_malloc(l1_sz2);
218e99
             int ret;
218e99
 
218e99
-            ret = bdrv_read(bs->file, l1_ofs / BDRV_SECTOR_SIZE, (uint8_t *)l1,
218e99
-                            l1_sz * sizeof(uint64_t) / BDRV_SECTOR_SIZE);
218e99
-
218e99
+            ret = bdrv_pread(bs->file, l1_ofs, l1, l1_sz2);
218e99
             if (ret < 0) {
218e99
                 g_free(l1);
218e99
                 return ret;
218e99
-- 
218e99
1.7.1
218e99