This fix bound check bug accessing last cluster if image size is not cluster aligned caused by "Unlock during COW" patch.
Signed-off-by: Frediano Ziglio <fredd...@gmail.com> --- block/qcow2-cluster.c | 8 ++++++-- block/qcow2.c | 2 +- block/qcow2.h | 2 ++ 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index c9a1b1c..78e1b49 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -295,16 +295,20 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect, BDRVQcowState *s = bs->opaque; int n, ret; void *buf; + QEMUIOVector qiov; + struct iovec iov; n = n_end - n_start; if (n <= 0) { return 0; } - buf = qemu_blockalign(bs, n * BDRV_SECTOR_SIZE); + iov.iov_base = buf = qemu_blockalign(bs, n * BDRV_SECTOR_SIZE); + iov.iov_len = n * BDRV_SECTOR_SIZE; + qemu_iovec_init_external(&qiov, &iov, 1); BLKDBG_EVENT(bs->file, BLKDBG_COW_READ); - ret = bdrv_read(bs, start_sect + n_start, buf, n); + ret = qcow2_co_readv(bs, start_sect + n_start, n, &qiov); if (ret < 0) { goto out; } diff --git a/block/qcow2.c b/block/qcow2.c index 510ff68..fd90881 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -376,7 +376,7 @@ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov, return n1; } -static int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num, +int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num, int remaining_sectors, QEMUIOVector *qiov) { BDRVQcowState *s = bs->opaque; diff --git a/block/qcow2.h b/block/qcow2.h index 531af39..7f5ff42 100644 --- a/block/qcow2.h +++ b/block/qcow2.h @@ -176,6 +176,8 @@ static inline int64_t align_offset(int64_t offset, int n) /* qcow2.c functions */ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov, int64_t sector_num, int nb_sectors); +int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num, + int remaining_sectors, QEMUIOVector *qiov); /* qcow2-refcount.c functions */ int qcow2_refcount_init(BlockDriverState *bs); -- 1.7.1