From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:59735) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SSRsV-00012s-T2 for qemu-devel@nongnu.org; Thu, 10 May 2012 07:49:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SSRsQ-0006CV-Sd for qemu-devel@nongnu.org; Thu, 10 May 2012 07:49:51 -0400 Received: from mx1.redhat.com ([209.132.183.28]:17390) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SSRsQ-0006C4-Kc for qemu-devel@nongnu.org; Thu, 10 May 2012 07:49:46 -0400 From: Kevin Wolf Date: Thu, 10 May 2012 13:49:11 +0200 Message-Id: <1336650574-12835-8-git-send-email-kwolf@redhat.com> In-Reply-To: <1336650574-12835-1-git-send-email-kwolf@redhat.com> References: <1336650574-12835-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 07/30] block: fix allocation size for dirty bitmap List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: anthony@codemonkey.ws Cc: kwolf@redhat.com, qemu-devel@nongnu.org From: Paolo Bonzini Also reuse elsewhere the new constant for sizeof(unsigned long) * 8. The dirty bitmap is allocated in bits but declared as unsigned long. Thus, its memory block is accessed beyond its end unless the image is a multiple of 64 chunks (i.e. a multiple of 64 MB). Signed-off-by: Paolo Bonzini Signed-off-by: Kevin Wolf --- block.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) diff --git a/block.c b/block.c index 754a422..3db84cd 100644 --- a/block.c +++ b/block.c @@ -1584,6 +1584,8 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num, return bdrv_rw_co(bs, sector_num, buf, nb_sectors, false); } +#define BITS_PER_LONG (sizeof(unsigned long) * 8) + static void set_dirty_bitmap(BlockDriverState *bs, int64_t sector_num, int nb_sectors, int dirty) { @@ -1594,8 +1596,8 @@ static void set_dirty_bitmap(BlockDriverState *bs, int64_t sector_num, end = (sector_num + nb_sectors - 1) / BDRV_SECTORS_PER_DIRTY_CHUNK; for (; start <= end; start++) { - idx = start / (sizeof(unsigned long) * 8); - bit = start % (sizeof(unsigned long) * 8); + idx = start / BITS_PER_LONG; + bit = start % BITS_PER_LONG; val = bs->dirty_bitmap[idx]; if (dirty) { if (!(val & (1UL << bit))) { @@ -3900,10 +3902,10 @@ void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable) if (enable) { if (!bs->dirty_bitmap) { bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS) + - BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1; - bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8; + BDRV_SECTORS_PER_DIRTY_CHUNK * BITS_PER_LONG - 1; + bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * BITS_PER_LONG; - bs->dirty_bitmap = g_malloc0(bitmap_size); + bs->dirty_bitmap = g_new0(unsigned long, bitmap_size); } } else { if (bs->dirty_bitmap) { -- 1.7.6.5