| 1 | The following changes since commit 61c265f0660ee476985808c8aa7915617c44fd53: | 1 | The following changes since commit ea9cdbcf3a0b8d5497cddf87990f1b39d8f3bb0a: |
|---|---|---|---|
| 2 | 2 | ||
| 3 | Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20200313a' into staging (2020-03-13 10:33:04 +0000) | 3 | Merge tag 'hw-misc-20240913' of https://github.com/philmd/qemu into staging (2024-09-15 18:27:40 +0100) |
| 4 | 4 | ||
| 5 | are available in the Git repository at: | 5 | are available in the Git repository at: |
| 6 | 6 | ||
| 7 | https://github.com/stefanha/qemu.git tags/block-pull-request | 7 | https://gitlab.com/stefanha/qemu.git tags/block-pull-request |
| 8 | 8 | ||
| 9 | for you to fetch changes up to 4ab78b19189a81038e744728ed949d09aa477550: | 9 | for you to fetch changes up to 89cd6254b80784a1b3f574407192493ef92fe65f: |
| 10 | 10 | ||
| 11 | block/io: fix bdrv_co_do_copy_on_readv (2020-03-16 11:46:11 +0000) | 11 | hw/block: fix uint32 overflow (2024-09-17 12:12:30 +0200) |
| 12 | 12 | ||
| 13 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
| 14 | Pull request | 14 | Pull request |
| 15 | 15 | ||
| 16 | An integer overflow fix for the last zone on a zoned block device whose | ||
| 17 | capacity is not a multiple of the zone size. | ||
| 18 | |||
| 16 | ---------------------------------------------------------------- | 19 | ---------------------------------------------------------------- |
| 17 | 20 | ||
| 18 | Vladimir Sementsov-Ogievskiy (1): | 21 | Dmitry Frolov (1): |
| 19 | block/io: fix bdrv_co_do_copy_on_readv | 22 | hw/block: fix uint32 overflow |
| 20 | 23 | ||
| 21 | block/io.c | 2 +- | 24 | hw/block/virtio-blk.c | 2 +- |
| 22 | 1 file changed, 1 insertion(+), 1 deletion(-) | 25 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 23 | 26 | ||
| 24 | -- | 27 | -- |
| 25 | 2.24.1 | 28 | 2.46.0 |
| 26 | diff view generated by jsdifflib |
| 1 | From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 1 | From: Dmitry Frolov <frolov@swemel.ru> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up | 3 | The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow |
| 4 | buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end | 4 | uint32. |
| 5 | anyway. | ||
| 6 | 5 | ||
| 7 | But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on | 6 | Found by Linux Verification Center (linuxtesting.org) with SVACE. |
| 8 | part of original qiov, defined by qiov_offset and bytes. So we must not | ||
| 9 | touch qiov behind qiov_offset+bytes bound. Fix it. | ||
| 10 | 7 | ||
| 11 | Cc: qemu-stable@nongnu.org # v4.2 | 8 | Signed-off-by: Dmitry Frolov <frolov@swemel.ru> |
| 12 | Fixes: 1143ec5ebf4 | 9 | Message-id: 20240917080356.270576-2-frolov@swemel.ru |
| 13 | Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | ||
| 14 | Reviewed-by: John Snow <jsnow@redhat.com> | ||
| 15 | Message-id: 20200312081949.5350-1-vsementsov@virtuozzo.com | ||
| 16 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 10 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
| 17 | --- | 11 | --- |
| 18 | block/io.c | 2 +- | 12 | hw/block/virtio-blk.c | 2 +- |
| 19 | 1 file changed, 1 insertion(+), 1 deletion(-) | 13 | 1 file changed, 1 insertion(+), 1 deletion(-) |
| 20 | 14 | ||
| 21 | diff --git a/block/io.c b/block/io.c | 15 | diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c |
| 22 | index XXXXXXX..XXXXXXX 100644 | 16 | index XXXXXXX..XXXXXXX 100644 |
| 23 | --- a/block/io.c | 17 | --- a/hw/block/virtio-blk.c |
| 24 | +++ b/block/io.c | 18 | +++ b/hw/block/virtio-blk.c |
| 25 | @@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child, | 19 | @@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op) |
| 26 | if (!(flags & BDRV_REQ_PREFETCH)) { | 20 | } else { |
| 27 | qemu_iovec_from_buf(qiov, qiov_offset + progress, | 21 | if (bs->bl.zone_size > capacity - offset) { |
| 28 | bounce_buffer + skip_bytes, | 22 | /* The zoned device allows the last smaller zone. */ |
| 29 | - pnum - skip_bytes); | 23 | - len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1); |
| 30 | + MIN(pnum - skip_bytes, bytes - progress)); | 24 | + len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1ull); |
| 31 | } | 25 | } else { |
| 32 | } else if (!(flags & BDRV_REQ_PREFETCH)) { | 26 | len = bs->bl.zone_size; |
| 33 | /* Read directly into the destination */ | 27 | } |
| 34 | -- | 28 | -- |
| 35 | 2.24.1 | 29 | 2.46.0 |
| 36 | diff view generated by jsdifflib |