[Qemu-devel] [PATCH v2 1/2] qcow2: Undo leaked allocations in co_writev

[Max Reitz <mreitz@redhat.com>]

If the write request spans more than one L2 table,
qcow2_alloc_cluster_offset cannot handle the required allocations
atomically. This results in leaks if it allocated new clusters in any
but the last L2 table touched and an error occurs in qcow2_co_writev
before having established the L2 link. These non-atomic allocations
were, however, indeed successful and are therefore given to the caller
in the L2Meta list.

If an error occurs in qcow2_co_writev and the L2Meta list is unwound,
all its remaining entries are clusters whose L2 links were not yet
established. Thus, all allocations in that list should be undone.

Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/qcow2.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/block/qcow2.c b/block/qcow2.c
index 13e34f0..69d8270 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1078,6 +1078,14 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
                 goto fail;
             }
 
+            /* WARNING: If adding a "goto fail" anywhere from here until the
+             * current QCowL2Meta element is removed from the l2meta list (that
+             * is, until the end of this loop), mind the qcow2_free_clusters()
+             * call after the fail label. Always make sure that every list
+             * element with a non-zero nb_clusters value remaining when reaching
+             * the while loop after that label indeed corresponds to a leaked
+             * allocation which has to be freed. */
+
             /* Take the request off the list of running requests */
             if (l2meta->nb_clusters != 0) {
                 QLIST_REMOVE(l2meta, next_in_flight);
@@ -1103,6 +1111,13 @@ fail:
     while (l2meta != NULL) {
         QCowL2Meta *next;
 
+        /* Undo all leaked allocations */
+        if (l2meta->nb_clusters != 0) {
+            qcow2_free_clusters(bs, l2meta->alloc_offset,
+                                l2meta->nb_clusters << s->cluster_bits,
+                                QCOW2_DISCARD_OTHER);
+        }
+
         if (l2meta->nb_clusters != 0) {
             QLIST_REMOVE(l2meta, next_in_flight);
         }
-- 
1.8.3.1