From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43007) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YB1qy-0002U7-R7 for qemu-devel@nongnu.org; Tue, 13 Jan 2015 08:49:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YB1qx-0006TE-Rk for qemu-devel@nongnu.org; Tue, 13 Jan 2015 08:49:52 -0500 Received: from mx1.redhat.com ([209.132.183.28]:43518) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YB1qx-0006T1-Ha for qemu-devel@nongnu.org; Tue, 13 Jan 2015 08:49:51 -0500 From: Stefan Hajnoczi Date: Tue, 13 Jan 2015 13:48:10 +0000 Message-Id: <1421156896-11599-33-git-send-email-stefanha@redhat.com> In-Reply-To: <1421156896-11599-1-git-send-email-stefanha@redhat.com> References: <1421156896-11599-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL v3 32/38] block: limited request size in write zeroes unsupported path List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Peter Lieven , Stefan Hajnoczi From: Peter Lieven If bs->bl.max_write_zeroes is large and we end up in the unsupported path we might allocate a lot of memory for the iovector and/or even generate an oversized requests. Fix this by limiting the request by the minimum of the reported maximum transfer size or 16MB (32768 sectors). Reported-by: Denis V. Lunev Signed-off-by: Peter Lieven Reviewed-by: Denis V. Lunev Message-id: 1420457389-16332-1-git-send-email-pl@kamp.de Signed-off-by: Stefan Hajnoczi --- block.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/block.c b/block.c index e76a223..371d0f6 100644 --- a/block.c +++ b/block.c @@ -3244,6 +3244,9 @@ static int coroutine_fn bdrv_co_do_write_zeroes(BlockDriverState *bs, if (ret == -ENOTSUP) { /* Fall back to bounce buffer if write zeroes is unsupported */ + int max_xfer_len = MIN_NON_ZERO(bs->bl.max_transfer_length, + MAX_WRITE_ZEROES_DEFAULT); + num = MIN(num, max_xfer_len); iov.iov_len = num * BDRV_SECTOR_SIZE; if (iov.iov_base == NULL) { iov.iov_base = qemu_try_blockalign(bs, num * BDRV_SECTOR_SIZE); @@ -3260,7 +3263,7 @@ static int coroutine_fn bdrv_co_do_write_zeroes(BlockDriverState *bs, /* Keep bounce buffer around if it is big enough for all * all future requests. */ - if (num < max_write_zeroes) { + if (num < max_xfer_len) { qemu_vfree(iov.iov_base); iov.iov_base = NULL; } -- 2.1.0