From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MODFz-0002dz-50 for qemu-devel@nongnu.org; Tue, 07 Jul 2009 12:10:59 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MODFu-0002co-2d for qemu-devel@nongnu.org; Tue, 07 Jul 2009 12:10:58 -0400 Received: from [199.232.76.173] (port=37912 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MODFt-0002ci-Q8 for qemu-devel@nongnu.org; Tue, 07 Jul 2009 12:10:53 -0400 Received: from mx2.redhat.com ([66.187.237.31]:57443) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1MODFt-0004i2-BI for qemu-devel@nongnu.org; Tue, 07 Jul 2009 12:10:53 -0400 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n67GAqMM016422 for ; Tue, 7 Jul 2009 12:10:52 -0400 From: Kevin Wolf Date: Tue, 7 Jul 2009 18:09:42 +0200 Message-Id: <1246982982-11615-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] qcow2: Fix L1 table memory allocation List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf Contrary to what one could expect, the size of L1 tables is not cluster aligned. So as we're writing whole sectors now instead of single entries, we need to ensure that the L1 table in memory is large enough; otherwise write would access memory after the end of the L1 table. Signed-off-by: Kevin Wolf --- block/qcow2-cluster.c | 2 +- block/qcow2-refcount.c | 2 +- block/qcow2.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index d349655..057dac5 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -47,7 +47,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size) #endif new_l1_size2 = sizeof(uint64_t) * new_l1_size; - new_l1_table = qemu_mallocz(new_l1_size2); + new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512)); memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t)); /* write new table (align to cluster) */ diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index d42c6e6..e6c857e 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -513,7 +513,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs, l1_size2 = l1_size * sizeof(uint64_t); l1_allocated = 0; if (l1_table_offset != s->l1_table_offset) { - l1_table = qemu_malloc(l1_size2); + l1_table = qemu_mallocz(align_offset(l1_size2, 512)); l1_allocated = 1; if (bdrv_pread(s->hd, l1_table_offset, l1_table, l1_size2) != l1_size2) diff --git a/block/qcow2.c b/block/qcow2.c index 20c114b..607329b 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -208,7 +208,8 @@ static int qcow_open(BlockDriverState *bs, const char *filename, int flags) if (s->l1_size < s->l1_vm_state_index) goto fail; s->l1_table_offset = header.l1_table_offset; - s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t)); + s->l1_table = qemu_mallocz( + align_offset(s->l1_size * sizeof(uint64_t), 512)); if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) != s->l1_size * sizeof(uint64_t)) goto fail; -- 1.6.0.6