qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] c8bf9a: qcow2: Fix corruption on write_zeroes


From: Peter Maydell
Subject: [Qemu-commits] [qemu/qemu] c8bf9a: qcow2: Fix corruption on write_zeroes with MAY_UNMAP
Date: Tue, 24 Nov 2020 13:18:03 -0800

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: c8bf9a9169db094aaed680cdba570758c0dc18b9
      
https://github.com/qemu/qemu/commit/c8bf9a9169db094aaed680cdba570758c0dc18b9
  Author: Maxim Levitsky <mlevitsk@redhat.com>
  Date:   2020-11-24 (Tue, 24 Nov 2020)

  Changed paths:
    M block/qcow2-cluster.c

  Log Message:
  -----------
  qcow2: Fix corruption on write_zeroes with MAY_UNMAP

Commit 205fa50750 ("qcow2: Add subcluster support to zero_in_l2_slice()")
introduced a subtle change to code in zero_in_l2_slice:

It swapped the order of

1. qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_slice);
2. set_l2_entry(s, l2_slice, l2_index + i, QCOW_OFLAG_ZERO);
3. qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);

To

1. qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_slice);
2. qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
3. set_l2_entry(s, l2_slice, l2_index + i, QCOW_OFLAG_ZERO);

It seems harmless, however the call to qcow2_free_any_clusters can
trigger a cache flush which can mark the L2 table as clean, and
assuming that this was the last write to it, a stale version of it
will remain on the disk.

Now we have a valid L2 entry pointing to a freed cluster. Oops.

Fixes: 205fa50750 ("qcow2: Add subcluster support to zero_in_l2_slice()")
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
[ kwolf: Fixed to restore the correct original order from before
  205fa50750; added comments like in discard_in_l2_slice(). ]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20201124092815.39056-1-kwolf@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>


  Commit: c0e0a9b13177c27ea8c887fef5613e5d72818b85
      
https://github.com/qemu/qemu/commit/c0e0a9b13177c27ea8c887fef5613e5d72818b85
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-24 (Tue, 24 Nov 2020)

  Changed paths:
    M block/qcow2-cluster.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Patches for 5.2.0-rc3:

- qcow2: Fix corruption on write_zeroes with MAY_UNMAP

# gpg: Signature made Tue 24 Nov 2020 14:23:36 GMT
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  qcow2: Fix corruption on write_zeroes with MAY_UNMAP

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/cef64a0b347b...c0e0a9b13177



reply via email to

[Prev in Thread] Current Thread [Next in Thread]