From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=47275 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1OEoOI-0005wX-Ry
	for qemu-devel@nongnu.org; Wed, 19 May 2010 14:53:16 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69)
	(envelope-from <hch@lst.de>) id 1OEoOG-0006CC-3s
	for qemu-devel@nongnu.org; Wed, 19 May 2010 14:53:13 -0400
Received: from verein.lst.de ([213.95.11.210]:55977)
	by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from <hch@lst.de>)
	id 1OEoOF-0006Br-Rw
	for qemu-devel@nongnu.org; Wed, 19 May 2010 14:53:12 -0400
Date: Wed, 19 May 2010 20:53:10 +0200
From: Christoph Hellwig <hch@lst.de>
Message-ID: <20100519185309.GA27591@lst.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] block: fix sector comparism in
	multiwrite_req_compare
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Kevin Wolf <kwolf@redhat.com>
Cc: Michael Tokarev <mjt@tls.msk.ru>, qemu-devel@nongnu.org

The difference between the start sectors of two requests can be larger
than the size of the "int" type, which can lead to a not correctly
sorted multiwrite array and thus spurious I/O errors and filesystem
corruption due to incorrect request merges.

So instead of doing the cute sector arithmetics trick spell out the
exact comparisms.

Spotted by Kevin Wolf based on a testcase from Michael Tokarev.

Signed-off-by: Christoph Hellwig <hch@lst.de>

Index: qemu/block.c
===================================================================
--- qemu.orig/block.c	2010-05-19 17:08:24.970255636 +0200
+++ qemu/block.c	2010-05-19 17:17:34.227006021 +0200
@@ -1933,7 +1933,19 @@ static void multiwrite_cb(void *opaque,
 
 static int multiwrite_req_compare(const void *a, const void *b)
 {
-    return (((BlockRequest*) a)->sector - ((BlockRequest*) b)->sector);
+    const BlockRequest *req1 = a, *req2 = b;
+
+    /*
+     * Note that we can't simply subtract req2->sector from req1->sector
+     * here as that could overflow the return value.
+     */
+    if (req1->sector > req2->sector) {
+        return 1;
+    } else if (req1->sector < req2->sector) {
+        return -1;
+    } else {
+        return 0;
+    }
 }
 
 /*