From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kevin Wolf Subject: Re: Endless loop in qcow2_alloc_cluster_offset Date: Mon, 07 Dec 2009 17:26:00 +0100 Message-ID: <4B1D2C98.6060502@redhat.com> References: <4B0537EB.4000909@siemens.com> <4B055AEF.4030406@redhat.com> <4B055D32.3040601@siemens.com> <4B1D0E34.6070907@siemens.com> <4B1D1882.7040404@redhat.com> <4B1D28C9.70201@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: qemu-devel , kvm To: Jan Kiszka Return-path: Received: from mx1.redhat.com ([209.132.183.28]:30158 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935371AbZLGQ1D (ORCPT ); Mon, 7 Dec 2009 11:27:03 -0500 In-Reply-To: <4B1D28C9.70201@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: Am 07.12.2009 17:09, schrieb Jan Kiszka: > Kevin Wolf wrote: >> In qcow_aio_write_cb there isn't much happening between these calls. The >> only thing that could somehow become dangerous is the >> qcow_aio_write_cb(req, 0); for queued requests in run_dependent_requests. > > If m->nb_clusters is not, the entry won't be removed from the list. And > of something corrupted nb_clusters so that it became 0 although it's > still enqueued, we would see the deadly loop I faced, right? > Unfortunately, any arbitrary memory corruption that generates such zeros > can cause this... Right, this looks like another way to get into that endless loop. I don't think it's very likely the cause, but who knows. Kevin From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NHgQd-0005rn-LJ for qemu-devel@nongnu.org; Mon, 07 Dec 2009 11:27:15 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NHgQY-0005oQ-HR for qemu-devel@nongnu.org; Mon, 07 Dec 2009 11:27:14 -0500 Received: from [199.232.76.173] (port=41420 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NHgQW-0005o6-H6 for qemu-devel@nongnu.org; Mon, 07 Dec 2009 11:27:08 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42125) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NHgQW-0007mh-Ml for qemu-devel@nongnu.org; Mon, 07 Dec 2009 11:27:08 -0500 Message-ID: <4B1D2C98.6060502@redhat.com> Date: Mon, 07 Dec 2009 17:26:00 +0100 From: Kevin Wolf MIME-Version: 1.0 References: <4B0537EB.4000909@siemens.com> <4B055AEF.4030406@redhat.com> <4B055D32.3040601@siemens.com> <4B1D0E34.6070907@siemens.com> <4B1D1882.7040404@redhat.com> <4B1D28C9.70201@siemens.com> In-Reply-To: <4B1D28C9.70201@siemens.com> Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] Re: Endless loop in qcow2_alloc_cluster_offset List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jan Kiszka Cc: qemu-devel , kvm Am 07.12.2009 17:09, schrieb Jan Kiszka: > Kevin Wolf wrote: >> In qcow_aio_write_cb there isn't much happening between these calls. The >> only thing that could somehow become dangerous is the >> qcow_aio_write_cb(req, 0); for queued requests in run_dependent_requests. > > If m->nb_clusters is not, the entry won't be removed from the list. And > of something corrupted nb_clusters so that it became 0 although it's > still enqueued, we would see the deadly loop I faced, right? > Unfortunately, any arbitrary memory corruption that generates such zeros > can cause this... Right, this looks like another way to get into that endless loop. I don't think it's very likely the cause, but who knows. Kevin