[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] c8bf9a: qcow2: Fix corruption on write_zeroes
From: |
Peter Maydell |
Subject: |
[Qemu-commits] [qemu/qemu] c8bf9a: qcow2: Fix corruption on write_zeroes with MAY_UNMAP |
Date: |
Tue, 24 Nov 2020 13:18:03 -0800 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: c8bf9a9169db094aaed680cdba570758c0dc18b9
https://github.com/qemu/qemu/commit/c8bf9a9169db094aaed680cdba570758c0dc18b9
Author: Maxim Levitsky <mlevitsk@redhat.com>
Date: 2020-11-24 (Tue, 24 Nov 2020)
Changed paths:
M block/qcow2-cluster.c
Log Message:
-----------
qcow2: Fix corruption on write_zeroes with MAY_UNMAP
Commit 205fa50750 ("qcow2: Add subcluster support to zero_in_l2_slice()")
introduced a subtle change to code in zero_in_l2_slice:
It swapped the order of
1. qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_slice);
2. set_l2_entry(s, l2_slice, l2_index + i, QCOW_OFLAG_ZERO);
3. qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
To
1. qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_slice);
2. qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
3. set_l2_entry(s, l2_slice, l2_index + i, QCOW_OFLAG_ZERO);
It seems harmless, however the call to qcow2_free_any_clusters can
trigger a cache flush which can mark the L2 table as clean, and
assuming that this was the last write to it, a stale version of it
will remain on the disk.
Now we have a valid L2 entry pointing to a freed cluster. Oops.
Fixes: 205fa50750 ("qcow2: Add subcluster support to zero_in_l2_slice()")
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
[ kwolf: Fixed to restore the correct original order from before
205fa50750; added comments like in discard_in_l2_slice(). ]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20201124092815.39056-1-kwolf@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Commit: c0e0a9b13177c27ea8c887fef5613e5d72818b85
https://github.com/qemu/qemu/commit/c0e0a9b13177c27ea8c887fef5613e5d72818b85
Author: Peter Maydell <peter.maydell@linaro.org>
Date: 2020-11-24 (Tue, 24 Nov 2020)
Changed paths:
M block/qcow2-cluster.c
Log Message:
-----------
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Patches for 5.2.0-rc3:
- qcow2: Fix corruption on write_zeroes with MAY_UNMAP
# gpg: Signature made Tue 24 Nov 2020 14:23:36 GMT
# gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg: issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream:
qcow2: Fix corruption on write_zeroes with MAY_UNMAP
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Compare: https://github.com/qemu/qemu/compare/cef64a0b347b...c0e0a9b13177