[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 38/97] nbd/server: fix bitmap export
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 38/97] nbd/server: fix bitmap export |
Date: |
Mon, 1 Apr 2019 15:59:12 -0500 |
From: Vladimir Sementsov-Ogievskiy <address@hidden>
bitmap_to_extents function is broken: it switches dirty variable after
every iteration, however it can process only part of dirty (or zero)
area during one iteration in case when this area is too large for one
extent.
Fortunately, the bug doesn't produce wrong extent flags: it just inserts
a zero-length extent between sequential extents representing large dirty
(or zero) area. However, zero-length extents are forbidden by the NBD
protocol. So, a careful client should consider such a reply as a server
fault, while a less-careful will likely ignore zero-length extents.
The bug can only be triggered by a client that requests block status
for nearly 4G at once (a request of 4G and larger is impossible per
the protocol, and requests smaller than 4G less the bitmap granularity
cause the loop to quit iterating rather than revisit the tail of the
large area); it also cannot trigger if the client used the
NBD_CMD_FLAG_REQ_ONE flag. Since qemu 3.0 as client (using the
x-dirty-bitmap extension) always passes the flag, it is immune; and
we are not aware of other open-source clients that know how to request
qemu:dirty-bitmap:FOO contexts. Clients that want to avoid the bug
could cap block status requests to a smaller length, such as 2G or 3G.
Fix this by more careful handling of dirty variable.
Bug was introduced in 3d068aff16
"nbd/server: implement dirty bitmap export", with the whole function.
and is present in v3.0.0 release.
Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
Message-Id: <address@hidden>
CC: address@hidden
Reviewed-by: Eric Blake <address@hidden>
[eblake: improved commit message]
Signed-off-by: Eric Blake <address@hidden>
(cherry picked from commit 6545916d528de7a6b784f4d10e7b236b30bfaced)
Signed-off-by: Michael Roth <address@hidden>
---
nbd/server.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/nbd/server.c b/nbd/server.c
index ea5fe0eb33..12f721482d 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1951,6 +1951,8 @@ static unsigned int bitmap_to_extents(BdrvDirtyBitmap
*bitmap, uint64_t offset,
assert(begin < overall_end && nb_extents);
while (begin < overall_end && i < nb_extents) {
+ bool next_dirty = !dirty;
+
if (dirty) {
end = bdrv_dirty_bitmap_next_zero(bitmap, begin);
} else {
@@ -1962,6 +1964,7 @@ static unsigned int bitmap_to_extents(BdrvDirtyBitmap
*bitmap, uint64_t offset,
end = MIN(bdrv_dirty_bitmap_size(bitmap),
begin + UINT32_MAX + 1 -
bdrv_dirty_bitmap_granularity(bitmap));
+ next_dirty = dirty;
}
if (dont_fragment && end > overall_end) {
end = overall_end;
@@ -1971,7 +1974,7 @@ static unsigned int bitmap_to_extents(BdrvDirtyBitmap
*bitmap, uint64_t offset,
extents[i].flags = cpu_to_be32(dirty ? NBD_STATE_DIRTY : 0);
i++;
begin = end;
- dirty = !dirty;
+ dirty = next_dirty;
}
bdrv_dirty_iter_free(it);
--
2.17.1
- [Qemu-stable] [PATCH 16/97] target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half, (continued)
- [Qemu-stable] [PATCH 16/97] target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 29/97] target/xtensa: fix FPU2000 bugs, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 35/97] block: Fix use after free error in bdrv_open_inherit(), Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 23/97] monitor: fix oob command leak, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 30/97] kvm: add call to qemu_add_opts() for -overcommit option, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 20/97] nvme: Fix nvme_init error handling, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 33/97] pc: acpi: revert back to 1 SRAT entry for hotpluggable area, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 36/97] job: Fix nested aio_poll() hanging in job_txn_apply, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 37/97] target/xtensa: fix s32c1i TCGMemOp flags, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 27/97] block: iotest to catch abort on forced blockjob cancel, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 38/97] nbd/server: fix bitmap export,
Michael Roth <=
- [Qemu-stable] [PATCH 43/97] block/rbd: add deprecation documentation for filename keyvalue pairs, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 45/97] ne2000: fix possible out of bound access in ne2000_receive, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 50/97] virtio: do not take address of packed members, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 56/97] nbd: fix NBD_FLAG_SEND_CACHE value, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 58/97] vhost-scsi: prevent using uninitialized vqs, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 59/97] target/xtensa: drop num_[core_]regs from dc232b/dc233c configs, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 04/97] target/arm: Fix typo in helper_sve_movz_d, Michael Roth, 2019/04/01