openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

block/io: bdrv_pdiscard: support int64_t bytes parameter 

This fixes at least one overflow in qcow2_process_discards, which
passes 64bit region length to bdrv_pdiscard where bytes (or sectors in
the past) parameter is int since its introduction in 0b919fae.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2019-04-23 15:57:05 +03:00 committed by Kevin Wolf
parent 1477b6c803
commit d93e572688
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
block/io.c
View File

@ -2632,7 +2632,7 @@ int bdrv_flush(BlockDriverState *bs)
typedef struct DiscardCo { typedef struct DiscardCo {
BdrvChild *child; BdrvChild *child;
int64_t offset; int64_t offset;
int bytes; int64_t bytes;
int ret; int ret;
} DiscardCo; } DiscardCo;
static void coroutine_fn bdrv_pdiscard_co_entry(void *opaque) static void coroutine_fn bdrv_pdiscard_co_entry(void *opaque)
@ -2643,14 +2643,15 @@ static void coroutine_fn bdrv_pdiscard_co_entry(void *opaque)
aio_wait_kick(); aio_wait_kick();
} }
int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset, int bytes) int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
int64_t bytes)
{ {
BdrvTrackedRequest req; BdrvTrackedRequest req;
int max_pdiscard, ret; int max_pdiscard, ret;
int head, tail, align; int head, tail, align;
BlockDriverState *bs = child->bs; BlockDriverState *bs = child->bs;
if (!bs || !bs->drv) { if (!bs || !bs->drv || !bdrv_is_inserted(bs)) {
return -ENOMEDIUM; return -ENOMEDIUM;
} }
@ -2658,9 +2659,8 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset, int bytes)
return -EPERM; return -EPERM;
} }
ret = bdrv_check_byte_request(bs, offset, bytes); if (offset < 0 || bytes < 0 || bytes > INT64_MAX - offset) {
if (ret < 0) { return -EIO;
return ret;
} }
/* Do nothing if disabled. */ /* Do nothing if disabled. */
@ -2695,7 +2695,7 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset, int bytes)
assert(max_pdiscard >= bs->bl.request_alignment); assert(max_pdiscard >= bs->bl.request_alignment);
while (bytes > 0) { while (bytes > 0) {
int num = bytes; int64_t num = bytes;
if (head) { if (head) {
/* Make small requests to get to alignment boundaries. */ /* Make small requests to get to alignment boundaries. */
@ -2757,7 +2757,7 @@ out:
return ret; return ret;
} }
int bdrv_pdiscard(BdrvChild *child, int64_t offset, int bytes) int bdrv_pdiscard(BdrvChild *child, int64_t offset, int64_t bytes)
{ {
Coroutine *co; Coroutine *co;
DiscardCo rwco = { DiscardCo rwco = {

4
include/block/block.h
View File

@ -434,8 +434,8 @@ void bdrv_drain_all(void);
AIO_WAIT_WHILE(bdrv_get_aio_context(bs_), \ AIO_WAIT_WHILE(bdrv_get_aio_context(bs_), \
cond); }) cond); })
int bdrv_pdiscard(BdrvChild *child, int64_t offset, int bytes); int bdrv_pdiscard(BdrvChild *child, int64_t offset, int64_t bytes);
int bdrv_co_pdiscard(BdrvChild *child, int64_t offset, int bytes); int bdrv_co_pdiscard(BdrvChild *child, int64_t offset, int64_t bytes);
int bdrv_has_zero_init_1(BlockDriverState *bs); int bdrv_has_zero_init_1(BlockDriverState *bs);
int bdrv_has_zero_init(BlockDriverState *bs); int bdrv_has_zero_init(BlockDriverState *bs);
bool bdrv_unallocated_blocks_are_zero(BlockDriverState *bs); bool bdrv_unallocated_blocks_are_zero(BlockDriverState *bs);