free_cluster_index is only correct if update_refcount() was called from
an allocation function, and even there it's brittle because it's used to
protect unfinished allocations which still have a refcount of 0 - if it
moves in the wrong place, the unfinished allocation can be corrupted.
So not using it any more seems to be a good idea. Instead, use the
first requested cluster to do the calculations. Return -EAGAIN if
unfinished allocations could become invalid and let the caller restart
its search for some free clusters.
The context of creating a snapsnot is one situation where
update_refcount() is called outside of a cluster allocation. For this
case, the change fixes a buffer overflow if a cluster is referenced in
an L2 table that cannot be represented by an existing refcount block.
(new_table[refcount_table_index] was out of bounds)
[Bump the qemu-iotests 026 refblock_alloc.write leak count from 10 to
11.
--Stefan]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
=== This is the QEMU I/O test suite ===
* Intro
This package contains a simple test suite for the I/O layer of qemu.
It does not require a guest, but only the qemu, qemu-img and qemu-io
binaries. This does limit it to exercise the low-level I/O path only
but no actual block drivers like ide, scsi or virtio.
* Usage
Just run ./check to run all tests for the raw image format, or ./check
-qcow2 to test the qcow2 image format. The output of ./check -h explains
additional options to test further image formats or I/O methods.
* Feedback and patches
Please send improvements to the test suite, general feedback or just
reports of failing tests cases to qemu-devel@savannah.nongnu.org.
b106ad9185