[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] block/io: fix bdrv_co_do_copy_on_readv
From: |
John Snow |
Subject: |
Re: [PATCH] block/io: fix bdrv_co_do_copy_on_readv |
Date: |
Thu, 12 Mar 2020 19:09:25 -0400 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 |
On 3/12/20 4:19 AM, Vladimir Sementsov-Ogievskiy wrote:
> Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up
> buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end
> anyway.
>
> But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on
> part of original qiov, defined by qiov_offset and bytes. So we must not
> touch qiov behind qiov_offset+bytes bound. Fix it.
>
For the purposes of the stable branch commit log, how does the bug
manifest? Are there known cases? What's the impact?
(Do we have tests?)
> Cc: address@hidden # v4.2
> Fixes: 1143ec5ebf4
> Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
> ---
> block/io.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/io.c b/block/io.c
> index 7e4cb74cf4..aba67f66b9 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -1399,7 +1399,7 @@ static int coroutine_fn
> bdrv_co_do_copy_on_readv(BdrvChild *child,
> if (!(flags & BDRV_REQ_PREFETCH)) {
> qemu_iovec_from_buf(qiov, qiov_offset + progress,
> bounce_buffer + skip_bytes,
> - pnum - skip_bytes);
> + MIN(pnum - skip_bytes, bytes -
> progress));
> }
> } else if (!(flags & BDRV_REQ_PREFETCH)) {
> /* Read directly into the destination */
>
Even if I don't understand the bug, the tighter bound seems provably
correct anyway, so...
Reviewed-by: John Snow <address@hidden>