From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53869) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YnocJ-0000MN-2g for qemu-devel@nongnu.org; Thu, 30 Apr 2015 09:35:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YnocD-0004pU-GQ for qemu-devel@nongnu.org; Thu, 30 Apr 2015 09:35:02 -0400 Date: Thu, 30 Apr 2015 15:34:52 +0200 From: Kevin Wolf Message-ID: <20150430133452.GB25594@noname.redhat.com> References: <1430140709-13599-1-git-send-email-famz@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1430140709-13599-1-git-send-email-famz@redhat.com> Subject: Re: [Qemu-devel] [PATCH v4 0/3] block: Fix unaligned bdrv_aio_write_zeroes List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fam Zheng Cc: pbonzini@redhat.com, qemu-block@nongnu.org, qemu-devel@nongnu.org, Stefan Hajnoczi , qemu-stable@nongnu.org Am 27.04.2015 um 15:18 hat Fam Zheng geschrieben: > An unaligned zero write causes NULL deferencing in bdrv_co_do_pwritev. That > path is reachable from bdrv_co_write_zeroes and bdrv_aio_write_zeroes. > > You can easily trigger through the former with qemu-io, as the test case added > by 61815d6e0aa. For bdrv_aio_write_zeroes, in common cases there's always a > format driver (which uses 512 alignment), so it would be much rarer to have > unaligned requests (only concerning top level here, when the request goes down > to bs->file, where for example the alignment is 4k, it would then be calling > bdrv_co_write_zeroes because it's in a coroutine). > > fc3959e4669a1c fixed bdrv_co_write_zeroes but not bdrv_aio_write_zeroes. The > lattern is the actually used one by device model. Revert the previous fix, do > it in bdrv_co_do_pwritev, to cover both paths. Hi Fam, Stefan's patch to split out block/io.c conflicts with this. Can you please rebase? Kevin