[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 32/55] qcow2: Fix corruption bug in qcow2_detect_metadata_preallo
From: |
Michael Roth |
Subject: |
[PATCH 32/55] qcow2: Fix corruption bug in qcow2_detect_metadata_preallocation() |
Date: |
Tue, 5 Nov 2019 14:52:20 -0600 |
From: Kevin Wolf <address@hidden>
qcow2_detect_metadata_preallocation() calls qcow2_get_refcount() which
requires s->lock to be taken to protect its accesses to the refcount
table and refcount blocks. However, nothing in this code path actually
took the lock. This could cause the same cache entry to be used by two
requests at the same time, for different tables at different offsets,
resulting in image corruption.
As it would be preferable to base the detection on consistent data (even
though it's just heuristics), let's take the lock not only around the
qcow2_get_refcount() calls, but around the whole function.
This patch takes the lock in qcow2_co_block_status() earlier and asserts
in qcow2_detect_metadata_preallocation() that we hold the lock.
Fixes: 69f47505ee66afaa513305de0c1895a224e52c45
Cc: address@hidden
Reported-by: Michael Weiser <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
Tested-by: Michael Weiser <address@hidden>
Reviewed-by: Michael Weiser <address@hidden>
Reviewed-by: Vladimir Sementsov-Ogievskiy <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
(cherry picked from commit 5e9785505210e2477e590e61b1ab100d0ec22b01)
Signed-off-by: Michael Roth <address@hidden>
---
block/qcow2-refcount.c | 2 ++
block/qcow2.c | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index ef965d7895..0d64bf5a5e 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -3455,6 +3455,8 @@ int qcow2_detect_metadata_preallocation(BlockDriverState
*bs)
int64_t i, end_cluster, cluster_count = 0, threshold;
int64_t file_length, real_allocation, real_clusters;
+ qemu_co_mutex_assert_locked(&s->lock);
+
file_length = bdrv_getlength(bs->file->bs);
if (file_length < 0) {
return file_length;
diff --git a/block/qcow2.c b/block/qcow2.c
index 865839682c..c0f5439dc8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1899,6 +1899,8 @@ static int coroutine_fn
qcow2_co_block_status(BlockDriverState *bs,
unsigned int bytes;
int status = 0;
+ qemu_co_mutex_lock(&s->lock);
+
if (!s->metadata_preallocation_checked) {
ret = qcow2_detect_metadata_preallocation(bs);
s->metadata_preallocation = (ret == 1);
@@ -1906,7 +1908,6 @@ static int coroutine_fn
qcow2_co_block_status(BlockDriverState *bs,
}
bytes = MIN(INT_MAX, count);
- qemu_co_mutex_lock(&s->lock);
ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
qemu_co_mutex_unlock(&s->lock);
if (ret < 0) {
--
2.17.1
- [PATCH 19/55] target/arm: Don't abort on M-profile exception return in linux-user mode, (continued)
- [PATCH 19/55] target/arm: Don't abort on M-profile exception return in linux-user mode, Michael Roth, 2019/11/05
- [PATCH 16/55] iotests: Restrict nbd Python tests to nbd, Michael Roth, 2019/11/05
- [PATCH 01/55] dma-helpers: ensure AIO callback is invoked after cancellation, Michael Roth, 2019/11/05
- [PATCH 23/55] curl: Keep pointer to the CURLState in CURLSocket, Michael Roth, 2019/11/05
- [PATCH 20/55] libvhost-user: fix SLAVE_SEND_FD handling, Michael Roth, 2019/11/05
- [PATCH 24/55] curl: Keep *socket until the end of curl_sock_cb(), Michael Roth, 2019/11/05
- [PATCH 15/55] iotests: Restrict file Python tests to file, Michael Roth, 2019/11/05
- [PATCH 17/55] iotests: Test blockdev-create for vpc, Michael Roth, 2019/11/05
- [PATCH 26/55] curl: Pass CURLSocket to curl_multi_do(), Michael Roth, 2019/11/05
- [PATCH 28/55] curl: Handle success in multi_check_completion, Michael Roth, 2019/11/05
- [PATCH 32/55] qcow2: Fix corruption bug in qcow2_detect_metadata_preallocation(),
Michael Roth <=
- [PATCH 36/55] make-release: pull in edk2 submodules so we can build it from tarballs, Michael Roth, 2019/11/05
- [PATCH 27/55] curl: Report only ready sockets, Michael Roth, 2019/11/05
- [PATCH 30/55] block/qcow2: Fix corruption introduced by commit 8ac0f15f335, Michael Roth, 2019/11/05
- [PATCH 29/55] blockjob: update nodes head while removing all bdrv, Michael Roth, 2019/11/05
- [PATCH 02/55] Revert "ide/ahci: Check for -ECANCELED in aio callbacks", Michael Roth, 2019/11/05
- [PATCH 22/55] block/nfs: tear down aio before nfs_close, Michael Roth, 2019/11/05
- [PATCH 31/55] coroutine: Add qemu_co_mutex_assert_locked(), Michael Roth, 2019/11/05
- [PATCH 33/55] block/backup: fix max_transfer handling for copy_range, Michael Roth, 2019/11/05
- [PATCH 38/55] s390: PCI: fix IOMMU region init, Michael Roth, 2019/11/05
- [PATCH 35/55] hw/arm/boot.c: Set NSACR.{CP11, CP10} for NS kernel boots, Michael Roth, 2019/11/05