[Qemu-devel] Re: Endless loop in qcow2_alloc_cluster_offset

[Kevin Wolf]

Am 07.12.2009 17:09, schrieb Jan Kiszka:
> Kevin Wolf wrote:
>> In qcow_aio_write_cb there isn't much happening between these calls. The
>> only thing that could somehow become dangerous is the
>> qcow_aio_write_cb(req, 0); for queued requests in run_dependent_requests.
> 
> If m->nb_clusters is not, the entry won't be removed from the list. And
> of something corrupted nb_clusters so that it became 0 although it's
> still enqueued, we would see the deadly loop I faced, right?
> Unfortunately, any arbitrary memory corruption that generates such zeros
> can cause this...

Right, this looks like another way to get into that endless loop. I
don't think it's very likely the cause, but who knows.

Kevin