[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] Possible corruption on qcow2_snapshot_goto
From: |
Frediano Ziglio |
Subject: |
[Qemu-devel] Possible corruption on qcow2_snapshot_goto |
Date: |
Fri, 5 Aug 2011 09:34:03 +0200 |
This function seems to be not that safe.
The first problem is that the first thing it does if free refcount
calling qcow2_update_snapshot_refcount(bs, s->l1_table_offset,
s->l1_size, -1). Now if something goes wrong (crash, disk errors) this
could lead to refcount == 0 (depending on L1 size, cache, open flags).
If table grow and qcow2_grow_l1_table needs to resize on disk it
probably will found some reference counter set to 0 (cause we already
decremented it), fail than qcow2_snapshot_goto return -EIO leaving
refcounts deallocated.
Frediano
- [Qemu-devel] Possible corruption on qcow2_snapshot_goto,
Frediano Ziglio <=