From: Christoph Hellwig <h...@lst.de>
The difference between the start sectors of two requests can be larger
than the size of the "int" type, which can lead to a not correctly
sorted multiwrite array and thus spurious I/O errors and filesystem
corruption due to incorrect request merges.
So instead of doing the cute sector arithmetics trick spell out the
exact comparisms.
Spotted by Kevin Wolf based on a testcase from Michael Tokarev.
Signed-off-by: Christoph Hellwig <h...@lst.de>
Signed-off-by: Kevin Wolf <kw...@redhat.com>
---
block.c | 14 +++++++++++++-
1 files changed, 13 insertions(+), 1 deletions(-)
diff --git a/block.c b/block.c
index bfe46e3..89eece7 100644
--- a/block.c
+++ b/block.c
@@ -1929,7 +1929,19 @@ static void multiwrite_cb(void *opaque, int ret)
static int multiwrite_req_compare(const void *a, const void *b)
{
- return (((BlockRequest*) a)->sector - ((BlockRequest*) b)->sector);
+ const BlockRequest *req1 = a, *req2 = b;
+
+ /*
+ * Note that we can't simply subtract req2->sector from req1->sector
+ * here as that could overflow the return value.
+ */
+ if (req1->sector > req2->sector) {
+ return 1;
+ } else if (req1->sector < req2->sector) {
+ return -1;
+ } else {
+ return 0;
+ }
}
/*
--
1.6.6.1
