diff options
| author | Alberto Garcia <berto@igalia.com> | 2020-04-06 16:34:01 +0200 |
|---|---|---|
| committer | Max Reitz <mreitz@redhat.com> | 2020-04-07 13:51:09 +0200 |
| commit | fb43d2d46e0daa491d7d80683dd11bb7b2f5899e (patch) | |
| tree | ab996ead09822894847f831873d0565b9cd70b94 /block/qcow2.c | |
| parent | 39f77cb662c6a7c4c398ee568ebc0ebcd710d0c4 (diff) | |
| download | qemu-fb43d2d46e0daa491d7d80683dd11bb7b2f5899e.zip | |
qcow2: Check request size in qcow2_co_pwritev_compressed_part()
When issuing a compressed write request the number of bytes must be a
multiple of the cluster size or reach the end of the last cluster.
With the current code such requests are allowed and we hit an
assertion:
$ qemu-img create -f qcow2 img.qcow2 1M
$ qemu-io -c 'write -c 0 32k' img.qcow2
qemu-io: block/qcow2.c:4257: qcow2_co_pwritev_compressed_task:
Assertion `bytes == s->cluster_size || (bytes < s->cluster_size &&
(offset + bytes == bs->total_sectors << BDRV_SECTOR_BITS))' failed.
Aborted
This patch fixes a regression introduced in 0d483dce38
Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200406143401.26854-1-berto@igalia.com>
Reviewed-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Diffstat (limited to 'block/qcow2.c')
| -rw-r--r-- | block/qcow2.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/block/qcow2.c b/block/qcow2.c index e8cbcc1ec1..b524b0c53f 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -4355,6 +4355,11 @@ qcow2_co_pwritev_compressed_part(BlockDriverState *bs, return -EINVAL; } + if (offset_into_cluster(s, bytes) && + (offset + bytes) != (bs->total_sectors << BDRV_SECTOR_BITS)) { + return -EINVAL; + } + while (bytes && aio_task_pool_status(aio) == 0) { uint64_t chunk_size = MIN(bytes, s->cluster_size); |