[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-stable] [PATCH v6 2/3] block: Fix NULL deference for unaligned
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-stable] [PATCH v6 2/3] block: Fix NULL deference for unaligned write if qiov is NULL |
Date: |
Tue, 12 May 2015 13:18:38 +0100 |
User-agent: |
Mutt/1.5.23 (2014-03-12) |
On Tue, May 12, 2015 at 02:09:31PM +0800, Fam Zheng wrote:
> +static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
> + int64_t offset,
> + unsigned int bytes,
> + BdrvRequestFlags flags)
> +{
> + BdrvTrackedRequest req;
> + uint8_t *buf = NULL;
> + QEMUIOVector local_qiov;
> + struct iovec iov;
> + uint64_t align = MAX(BDRV_SECTOR_SIZE, bs->request_alignment);
> + unsigned int head_padding_bytes, tail_padding_bytes;
> + int ret;
> +
> + head_padding_bytes = offset & (align - 1);
> + tail_padding_bytes = align - ((offset + bytes) & (align - 1));
> + tracked_request_begin(&req, bs, offset, bytes, true);
> +
> + mark_request_serialising(&req, align);
This is only necessary if (head_padding_bytes || tail_padding_bytes).
Serialized requests are more expensive so let's only do it when
necessary.
> + wait_serialising_requests(&req);
> +
> + assert(flags & BDRV_REQ_ZERO_WRITE);
> + if (head_padding_bytes || tail_padding_bytes) {
> + buf = qemu_blockalign(bs, align);
> + iov = (struct iovec) {
> + .iov_base = buf,
> + .iov_len = align,
> + };
> + qemu_iovec_init_external(&local_qiov, &iov, 1);
> + }
> + if (head_padding_bytes) {
> + uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
> +
> + /* RMW the unaligned part before head. */
> + BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_HEAD);
> + ret = bdrv_aligned_preadv(bs, &req, offset & ~(align - 1), align,
> + align, &local_qiov, 0);
> + if (ret < 0) {
> + goto fail;
> + }
> + BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
> +
> + memset(buf + head_padding_bytes, 0, zero_bytes);
> + ret = bdrv_aligned_pwritev(bs, &req, offset & ~(align - 1), align,
> + &local_qiov,
> + flags & ~BDRV_REQ_ZERO_WRITE);
> + if (ret < 0) {
> + goto fail;
> + }
> + offset += zero_bytes;
> + bytes -= zero_bytes;
> + }
> +
> + assert((offset & (align - 1)) == 0);
> + if (bytes >= align) {
> + /* Write the aligned part in the middle. */
> + uint64_t aligned_bytes = bytes & ~(align - 1);
> + ret = bdrv_aligned_pwritev(bs, &req, offset, aligned_bytes,
> + NULL, flags);
> + if (ret < 0) {
> + goto fail;
> + }
> + bytes -= aligned_bytes;
> + offset += aligned_bytes;
> + }
> +
> + assert((offset & (align - 1)) == 0);
> + if (bytes) {
> + assert(align == tail_padding_bytes + bytes);
> + /* RMW the unaligned part after tail. */
> + BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_TAIL);
> + ret = bdrv_aligned_preadv(bs, &req, offset, align,
> + align, &local_qiov, 0);
> + if (ret < 0) {
> + goto fail;
> + }
> + BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
> +
> + memset(buf, 0, bytes);
> + printf("tail part %ld %d\n", offset, bytes);
Please drop the debug printf.
> + ret = bdrv_aligned_pwritev(bs, &req, offset, align,
> + &local_qiov, flags &
> ~BDRV_REQ_ZERO_WRITE);
> + }
> +fail:
> + tracked_request_end(&req);
> + if (buf) {
> + qemu_vfree(buf);
> + }
if (buf) is unnecessary. qemu_vfree(NULL) is a nop.
pgpx428ktxRY0.pgp
Description: PGP signature