[Qemu-commits] [COMMIT 3f6a3ee] qcow2: Fix L1 table memory allocation

[Anthony Liguori]

From: Kevin Wolf <address@hidden>

Contrary to what one could expect, the size of L1 tables is not cluster
aligned. So as we're writing whole sectors now instead of single entries,
we need to ensure that the L1 table in memory is large enough; otherwise
write would access memory after the end of the L1 table.

Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index d349655..057dac5 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -47,7 +47,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size)
 #endif
 
     new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = qemu_mallocz(new_l1_size2);
+    new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512));
     memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
 
     /* write new table (align to cluster) */
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index d42c6e6..e6c857e 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -513,7 +513,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
     l1_size2 = l1_size * sizeof(uint64_t);
     l1_allocated = 0;
     if (l1_table_offset != s->l1_table_offset) {
-        l1_table = qemu_malloc(l1_size2);
+        l1_table = qemu_mallocz(align_offset(l1_size2, 512));
         l1_allocated = 1;
         if (bdrv_pread(s->hd, l1_table_offset,
                        l1_table, l1_size2) != l1_size2)
diff --git a/block/qcow2.c b/block/qcow2.c
index 9a7c666..be507e7 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -200,7 +200,8 @@ static int qcow_open(BlockDriverState *bs, const char 
*filename, int flags)
     if (s->l1_size < s->l1_vm_state_index)
         goto fail;
     s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = qemu_mallocz(
+        align_offset(s->l1_size * sizeof(uint64_t), 512));
     if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * 
sizeof(uint64_t)) !=
         s->l1_size * sizeof(uint64_t))
         goto fail;