[Qemu-devel] [PATCH] qcow2: preserve free_byte_offset when qcow2_alloc_bytes() fails

[Qemu-devel] [PATCH] qcow2: preserve free_byte_offset when qcow2_alloc_bytes() fails

[Stefan Hajnoczi]

When qcow2_alloc_clusters() error handling code was introduced in commit
5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset
was clobbered in the error case.  This patch keeps free_byte_offset at 0
so we will try to allocate clusters again next time this function is
called.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 block/qcow2-refcount.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 812c93c..2d5420c 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -627,10 +627,11 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
     BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
     assert(size > 0 && size <= s->cluster_size);
     if (s->free_byte_offset == 0) {
-        s->free_byte_offset = qcow2_alloc_clusters(bs, s->cluster_size);
-        if (s->free_byte_offset < 0) {
-            return s->free_byte_offset;
+        offset = qcow2_alloc_clusters(bs, s->cluster_size);
+        if (offset < 0) {
+            return offset;
         }
+        s->free_byte_offset = offset;
     }
  redo:
     free_in_cluster = s->cluster_size -
-- 
1.7.10

Re: [Qemu-devel] [PATCH] qcow2: preserve free_byte_offset when qcow2_alloc_bytes() fails

[Kevin Wolf]

Am 18.06.2012 15:00, schrieb Stefan Hajnoczi:
> When qcow2_alloc_clusters() error handling code was introduced in commit
> 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset
> was clobbered in the error case.  This patch keeps free_byte_offset at 0
> so we will try to allocate clusters again next time this function is
> called.
> 
> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Thanks, applied to the block branch.

And I guess we should get test case 026 fixed up and extended to cover this.

Kevin

Re: [Qemu-devel] [PATCH] qcow2: preserve free_byte_offset when qcow2_alloc_bytes() fails

[Stefan Hajnoczi]

On Mon, Jun 18, 2012 at 2:11 PM, Kevin Wolf <kwolf@redhat.com> wrote:
> Am 18.06.2012 15:00, schrieb Stefan Hajnoczi:
>> When qcow2_alloc_clusters() error handling code was introduced in commit
>> 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset
>> was clobbered in the error case.  This patch keeps free_byte_offset at 0
>> so we will try to allocate clusters again next time this function is
>> called.
>>
>> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
>
> Thanks, applied to the block branch.
>
> And I guess we should get test case 026 fixed up and extended to cover this.

I'm not sure what to test.  It already returned the error code
correctly.  The problem was what happened when called again - there
would be junk in free_byte_offset.

Stefan

Re: [Qemu-devel] [PATCH] qcow2: preserve free_byte_offset when qcow2_alloc_bytes() fails

[Kevin Wolf]

Am 18.06.2012 15:16, schrieb Stefan Hajnoczi:
> On Mon, Jun 18, 2012 at 2:11 PM, Kevin Wolf <kwolf@redhat.com> wrote:
>> Am 18.06.2012 15:00, schrieb Stefan Hajnoczi:
>>> When qcow2_alloc_clusters() error handling code was introduced in commit
>>> 5d757b563d59142ca81e1073a8e8396750a0ad1a, the value of free_byte_offset
>>> was clobbered in the error case.  This patch keeps free_byte_offset at 0
>>> so we will try to allocate clusters again next time this function is
>>> called.
>>>
>>> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
>>
>> Thanks, applied to the block branch.
>>
>> And I guess we should get test case 026 fixed up and extended to cover this.
> 
> I'm not sure what to test.  It already returned the error code
> correctly.  The problem was what happened when called again - there
> would be junk in free_byte_offset.

Then this is what needs to be tested. For example:

1. Configure blkdebug to fail on BLKDBG_CLUSTER_ALLOC_BYTES once

2. write_compressed() fails with the configured errno, s->cluster_size
   is corrupted in the old version.

3. write_compressed() is expected to succeed. The buggy version may
   succeed as well, or fail somewhere else because of the negative
   (or wrapped around, huge) offset.

There are different ways to check if we wrote to the right offset,
probably the best way is to combine them:

4a. The obvious one: Read the data back. May or may not reveal a bug,
    depending on what the read code does with negative offsets.

4b. qemu-img info. The image file size is an indicator for this bug.

4c. Repeat the same procedure with a different cluster and a different
    pattern. Read back both. If the second one has overwritten the
    first one, there is a problem.

Kevin