#
9b14671a |
| 15-Sep-2020 |
Peter Maydell <peter.maydell@linaro.org> |
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-09-15' into staging
Block patches: - Several qcow2 fixes and refactorings - Let qemu-img convert try to stay at cluster boundaries
Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-09-15' into staging
Block patches: - Several qcow2 fixes and refactorings - Let qemu-img convert try to stay at cluster boundaries - Stable child names for quorum (with x-blockdev-change) - Explicitly drop vhdx 4k sector support, as it was never actually working - rbd: Mark @namespace a strong runtime option - iotests.py improvements - Drop unused runtime_opts objects - Skip a test case in 030 when run through make check-block
# gpg: Signature made Tue 15 Sep 2020 11:27:05 BST # gpg: using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40 # gpg: issuer "mreitz@redhat.com" # gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full] # Primary key fingerprint: 91BE B60A 30DB 3E88 57D1 1829 F407 DB00 61D5 CF40
* remotes/maxreitz/tags/pull-block-2020-09-15: (22 commits) block/rbd: add 'namespace' to qemu_rbd_strong_runtime_opts[] qcow2: Convert qcow2_alloc_cluster_offset() into qcow2_alloc_host_offset() qcow2: Make preallocate_co() resize the image to the correct size block/qcow: remove runtime opts block/rbd: remove runtime_opts qcow2: Return the original error code in qcow2_co_pwrite_zeroes() qcow2: Make qcow2_free_any_clusters() free only one cluster qcow2: Handle QCowL2Meta on error in preallocate_co() block/vhdx: Support vhdx image only with 512 bytes logical sector size iotests: Skip test_stream_parallel in test 030 when doing "make check" qemu-img: Explicit number replaced by a constant qcow2: Rewrite the documentation of qcow2_alloc_cluster_offset() qcow2: Don't check nb_clusters when removing l2meta from the list qcow2: Fix removal of list members from BDRVQcow2State.cluster_allocs qcow2: Use macros for the L1, refcount and bitmap table entry sizes qemu-img: avoid unaligned read requests during convert block/quorum.c: stable children names qemu-iotests: Simplify FilePath __init__ qemu-iotests: Merge FilePaths and FilePath qemu-iotests: Support varargs syntax in FilePaths ...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
184581fa |
| 03-Sep-2020 |
Alberto Garcia <berto@igalia.com> |
qcow2: Fix removal of list members from BDRVQcow2State.cluster_allocs
When a write request needs to allocate new clusters (or change the L2 bitmap of existing ones) a QCowL2Meta structure is created
qcow2: Fix removal of list members from BDRVQcow2State.cluster_allocs
When a write request needs to allocate new clusters (or change the L2 bitmap of existing ones) a QCowL2Meta structure is created so the L2 metadata can be later updated and any copy-on-write can be performed if necessary.
A write request can span a region consisting of an arbitrary combination of previously unallocated and allocated clusters, and if the unallocated ones can be put contiguous to the existing ones then QEMU will do so in order to minimize the number of write operations.
In practice this means that a write request has not just one but a number of QCowL2Meta structures. All of them are added to the cluster_allocs list that is stored in BDRVQcow2State and is used to detect overlapping requests. After the write request finishes all its associated QCowL2Meta are removed from that list. calculate_l2_meta() takes care of creating and putting those structures in the list, and qcow2_handle_l2meta() takes care of removing them.
The problem is that the error path in handle_alloc() also tries to remove an item in that list, a remnant from the time when this was handled there (that code would not even be correct anymore because it only removes one struct and not all the ones from the same write request).
This can trigger a double removal of the same item from the list, causing a crash. This is not easy to reproduce in practice because it requires that do_alloc_cluster_offset() fails after a successful previous allocation during the same write request, but it can be reproduced with the included test case.
Signed-off-by: Alberto Garcia <berto@igalia.com> Message-Id: <3440a1c4d53c4fe48312b478c96accb338cbef7c.1599150873.git.berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
show more ...
|