From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LqWt0-0001zu-Q1 for qemu-devel@nongnu.org; Sun, 05 Apr 2009 14:16:02 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LqWt0-0001yw-4W for qemu-devel@nongnu.org; Sun, 05 Apr 2009 14:16:02 -0400 Received: from [199.232.76.173] (port=59639 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LqWsz-0001yi-Kc for qemu-devel@nongnu.org; Sun, 05 Apr 2009 14:16:01 -0400 Received: from savannah.gnu.org ([199.232.41.3]:55151 helo=sv.gnu.org) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LqWsz-0007o0-DJ for qemu-devel@nongnu.org; Sun, 05 Apr 2009 14:16:01 -0400 Received: from cvs.savannah.gnu.org ([199.232.41.69]) by sv.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1LqWsy-00015C-FZ for qemu-devel@nongnu.org; Sun, 05 Apr 2009 18:16:00 +0000 Received: from aliguori by cvs.savannah.gnu.org with local (Exim 4.69) (envelope-from ) id 1LqWsy-000156-2S for qemu-devel@nongnu.org; Sun, 05 Apr 2009 18:16:00 +0000 MIME-Version: 1.0 Errors-To: aliguori Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Anthony Liguori Message-Id: Date: Sun, 05 Apr 2009 18:16:00 +0000 Subject: [Qemu-devel] [6986] Fix (at least one cause of) qcow2 corruption. Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Revision: 6986 http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6986 Author: aliguori Date: 2009-04-05 18:15:59 +0000 (Sun, 05 Apr 2009) Log Message: ----------- Fix (at least one cause of) qcow2 corruption. (Nolan Leake) qcow2's get_cluster_offset() scans forward in the l2 table to find other clusters that have the same allocation status as the first cluster. This is used by (among others) qcow_is_allocated(). Unfortunately, it was not checking to be sure that it didn't fall off the end of the l2 table. This patch adds that check. The symptom that motivated me to look into this was that bdrv_is_allocated() was returning false when there was in fact data there. This is one of many ways this bug could lead to data corruption. I checked the other place that scans for consecutive unallocated blocks (alloc_cluster_offset()) and it appears to be OK: nb_clusters = MIN(nb_clusters, s->l2_size - l2_index); appears to prevent the same problem from occurring. Signed-off-by: Nolan Leake sigbus.net> Signed-off-by: Anthony Liguori Modified Paths: -------------- branches/stable_0_10/block-qcow2.c Modified: branches/stable_0_10/block-qcow2.c =================================================================== --- branches/stable_0_10/block-qcow2.c 2009-04-05 18:15:54 UTC (rev 6985) +++ branches/stable_0_10/block-qcow2.c 2009-04-05 18:15:59 UTC (rev 6986) @@ -670,6 +670,10 @@ nb_available = (nb_available >> 9) + index_in_cluster; + if (nb_needed > nb_available) { + nb_needed = nb_available; + } + cluster_offset = 0; /* seek the the l2 offset in the l1 table */