From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47091) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ys3Nx-0002My-5w for qemu-devel@nongnu.org; Tue, 12 May 2015 02:09:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Ys3Nw-0007Uy-8l for qemu-devel@nongnu.org; Tue, 12 May 2015 02:09:45 -0400 From: Fam Zheng Date: Tue, 12 May 2015 14:09:29 +0800 Message-Id: <1431410972-13087-1-git-send-email-famz@redhat.com> Subject: [Qemu-devel] [PATCH v6 0/3] block: Fix unaligned bdrv_aio_write_zeroes List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , pbonzini@redhat.com, qemu-block@nongnu.org, qemu-stable@nongnu.org, Stefan Hajnoczi An unaligned zero write causes NULL deferencing in bdrv_co_do_pwritev. That path is reachable from bdrv_co_write_zeroes and bdrv_aio_write_zeroes. You can easily trigger through the former with qemu-io, as the test case added by 61815d6e0aa. For bdrv_aio_write_zeroes, in common cases there's always a format driver (which uses 512 alignment), so it would be much rarer to have unaligned requests (only concerning top level here, when the request goes down to bs->file, where for example the alignment is 4k, it would then be calling bdrv_co_write_zeroes because it's in a coroutine). fc3959e4669a1c fixed bdrv_co_write_zeroes but not bdrv_aio_write_zeroes. The lattern is the actually used one by device model. Revert the previous fix, do it in bdrv_co_do_pwritev, to cover both paths. v6: Split the function to make it easier to reason. (Stefan) Add rev-by in 1, 3. (Stefan) v5: Rebase on to the block/io.c split. (Kevin) v4: "if (!qiov)" -> "if (!qiov && bytes >= align)". (Paolo) v3: Fix the case where the unaligned request is contained within the first block. (Paolo) Also update iotests 033 to cover the code path with qemu-io. v2: Split to three aligned pwritev. Fam Zheng (3): Revert "block: Fix unaligned zero write" block: Fix NULL deference for unaligned write if qiov is NULL qemu-iotests: Test unaligned sub-block zero write block/io.c | 140 ++++++++++++++++++++++++++++++++------------- tests/qemu-iotests/033 | 13 +++++ tests/qemu-iotests/033.out | 30 ++++++++++ 3 files changed, 144 insertions(+), 39 deletions(-) -- 2.1.0