mirror of
https://github.com/xemu-project/xemu.git
synced 2024-11-24 20:19:44 +00:00
184581fa4d
When a write request needs to allocate new clusters (or change the L2 bitmap of existing ones) a QCowL2Meta structure is created so the L2 metadata can be later updated and any copy-on-write can be performed if necessary. A write request can span a region consisting of an arbitrary combination of previously unallocated and allocated clusters, and if the unallocated ones can be put contiguous to the existing ones then QEMU will do so in order to minimize the number of write operations. In practice this means that a write request has not just one but a number of QCowL2Meta structures. All of them are added to the cluster_allocs list that is stored in BDRVQcow2State and is used to detect overlapping requests. After the write request finishes all its associated QCowL2Meta are removed from that list. calculate_l2_meta() takes care of creating and putting those structures in the list, and qcow2_handle_l2meta() takes care of removing them. The problem is that the error path in handle_alloc() also tries to remove an item in that list, a remnant from the time when this was handled there (that code would not even be correct anymore because it only removes one struct and not all the ones from the same write request). This can trigger a double removal of the same item from the list, causing a crash. This is not easy to reproduce in practice because it requires that do_alloc_cluster_offset() fails after a successful previous allocation during the same write request, but it can be reproduced with the included test case. Signed-off-by: Alberto Garcia <berto@igalia.com> Message-Id: <3440a1c4d53c4fe48312b478c96accb338cbef7c.1599150873.git.berto@igalia.com> Signed-off-by: Max Reitz <mreitz@redhat.com> |
||
|---|---|---|
| .. | ||
| acceptance | ||
| data | ||
| decode | ||
| docker | ||
| fp | ||
| guest-debug | ||
| image-fuzzer | ||
| include | ||
| keys | ||
| migration | ||
| multiboot | ||
| perf/block/qcow2 | ||
| plugin | ||
| qapi-schema | ||
| qemu-iotests | ||
| qtest | ||
| rocker | ||
| tcg | ||
| tsan | ||
| uefi-test-tools | ||
| vm | ||
| vmstate-static-checker-data | ||
| .gitignore | ||
| atomic64-bench.c | ||
| atomic_add-bench.c | ||
| benchmark-crypto-cipher.c | ||
| benchmark-crypto-hash.c | ||
| benchmark-crypto-hmac.c | ||
| check-block-qdict.c | ||
| check-block.sh | ||
| check-qdict.c | ||
| check-qjson.c | ||
| check-qlist.c | ||
| check-qlit.c | ||
| check-qnull.c | ||
| check-qnum.c | ||
| check-qobject.c | ||
| check-qom-interface.c | ||
| check-qom-proplist.c | ||
| check-qstring.c | ||
| crypto-tls-psk-helpers.c | ||
| crypto-tls-psk-helpers.h | ||
| crypto-tls-x509-helpers.c | ||
| crypto-tls-x509-helpers.h | ||
| dbus-vmstate-daemon.sh | ||
| io-channel-helpers.c | ||
| io-channel-helpers.h | ||
| iothread.c | ||
| iothread.h | ||
| Makefile.include | ||
| meson.build | ||
| pkix_asn1_tab.c | ||
| ptimer-test-stubs.c | ||
| ptimer-test.c | ||
| ptimer-test.h | ||
| qht-bench.c | ||
| rcutorture.c | ||
| requirements.txt | ||
| socket-helpers.c | ||
| socket-helpers.h | ||
| test-aio-multithread.c | ||
| test-aio.c | ||
| test-authz-list.c | ||
| test-authz-listfile.c | ||
| test-authz-pam.c | ||
| test-authz-simple.c | ||
| test-base64.c | ||
| test-bdrv-drain.c | ||
| test-bdrv-graph-mod.c | ||
| test-bitcnt.c | ||
| test-bitmap.c | ||
| test-bitops.c | ||
| test-block-backend.c | ||
| test-block-iothread.c | ||
| test-blockjob-txn.c | ||
| test-blockjob.c | ||
| test-bufferiszero.c | ||
| test-char.c | ||
| test-clone-visitor.c | ||
| test-coroutine.c | ||
| test-crypto-afsplit.c | ||
| test-crypto-block.c | ||
| test-crypto-cipher.c | ||
| test-crypto-hash.c | ||
| test-crypto-hmac.c | ||
| test-crypto-ivgen.c | ||
| test-crypto-pbkdf.c | ||
| test-crypto-secret.c | ||
| test-crypto-tlscredsx509.c | ||
| test-crypto-tlssession.c | ||
| test-crypto-xts.c | ||
| test-cutils.c | ||
| test-hbitmap.c | ||
| test-image-locking.c | ||
| test-int128.c | ||
| test-io-channel-buffer.c | ||
| test-io-channel-command.c | ||
| test-io-channel-file.c | ||
| test-io-channel-socket.c | ||
| test-io-channel-tls.c | ||
| test-io-task.c | ||
| test-iov.c | ||
| test-keyval.c | ||
| test-logging.c | ||
| test-mul64.c | ||
| test-opts-visitor.c | ||
| test-qapi-util.c | ||
| test-qdev-global-props.c | ||
| test-qdist.c | ||
| test-qemu-opts.c | ||
| test-qga.c | ||
| test-qgraph.c | ||
| test-qht-par.c | ||
| test-qht.c | ||
| test-qmp-cmds.c | ||
| test-qmp-event.c | ||
| test-qobject-input-visitor.c | ||
| test-qobject-output-visitor.c | ||
| test-rcu-list.c | ||
| test-rcu-simpleq.c | ||
| test-rcu-slist.c | ||
| test-rcu-tailq.c | ||
| test-replication.c | ||
| test-shift128.c | ||
| test-string-input-visitor.c | ||
| test-string-output-visitor.c | ||
| test-thread-pool.c | ||
| test-throttle.c | ||
| test-timed-average.c | ||
| test-util-filemonitor.c | ||
| test-util-sockets.c | ||
| test-uuid.c | ||
| test-visitor-serialization.c | ||
| test-vmstate.c | ||
| test-write-threshold.c | ||
| test-x86-cpuid.c | ||
| test-xbzrle.c | ||
| vhost-user-bridge.c | ||