From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1Lomdm-0000Y3-Ew
	for qemu-devel@nongnu.org; Tue, 31 Mar 2009 18:41:06 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1Lomdg-0000XT-RN
	for qemu-devel@nongnu.org; Tue, 31 Mar 2009 18:41:05 -0400
Received: from [199.232.76.173] (port=42287 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Lomdg-0000XN-Mf
	for qemu-devel@nongnu.org; Tue, 31 Mar 2009 18:41:00 -0400
Received: from phong.sigbus.net ([65.49.35.42]:47564)
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <nolan@sigbus.net>) id 1Lomdg-0000jp-B3
	for qemu-devel@nongnu.org; Tue, 31 Mar 2009 18:41:00 -0400
Received: from [192.168.0.3] (c-71-202-202-194.hsd1.ca.comcast.net
	[71.202.202.194])
	by phong.sigbus.net (Postfix) with ESMTPSA id B8E9995C0A1
	for <qemu-devel@nongnu.org>; Tue, 31 Mar 2009 15:40:55 -0700 (PDT)
From: Nolan <nolan@sigbus.net>
Content-Type: text/plain
Date: Tue, 31 Mar 2009 15:40:54 -0700
Message-Id: <1238539254.15350.554.camel@voxel>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] [PATCH] Fix (at least one cause of) qcow2 corruption.
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>

qcow2's get_cluster_offset() scans forward in the l2 table to find other
clusters that have the same allocation status as the first cluster.
This is used by (among others) qcow_is_allocated().

Unfortunately, it was not checking to be sure that it didn't fall off
the end of the l2 table.  This patch adds that check.

The symptom that motivated me to look into this was that
bdrv_is_allocated() was returning false when there was in fact data
there.  This is one of many ways this bug could lead to data corruption.

I checked the other place that scans for consecutive unallocated blocks
(alloc_cluster_offset()) and it appears to be OK:
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
appears to prevent the same problem from occurring.

Signed-off-by: Nolan Leake <nolan <at> sigbus.net>

Index: block-qcow2.c
===================================================================
--- block-qcow2.c	(revision 6963)
+++ block-qcow2.c	(working copy)
@@ -761,6 +761,10 @@
 
     nb_available = (nb_available >> 9) + index_in_cluster;
 
+    if (nb_needed > nb_available) {
+        nb_needed = nb_available;
+    }
+
     cluster_offset = 0;
 
     /* seek the the l2 offset in the l1 table */