Series comparison

-[PULL for-6.1 0/3] Block patches
+[PULL 0/1] Block patches
-The following changes since commit 3521ade3510eb5cefb2e27a101667f25dad89935:
+The following changes since commit ea9cdbcf3a0b8d5497cddf87990f1b39d8f3bb0a:
-  Merge remote-tracking branch 'remotes/thuth-gitlab/tags/pull-request-2021-07-29' into staging (2021-07-29 13:17:20 +0100)
+  Merge tag 'hw-misc-20240913' of https://github.com/philmd/qemu into staging (2024-09-15 18:27:40 +0100)
 are available in the Git repository at:
   https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to cc8eecd7f105a1dff5876adeb238a14696061a4a:
+for you to fetch changes up to 89cd6254b80784a1b3f574407192493ef92fe65f:
-  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver (2021-07-29 17:17:34 +0100)
+  hw/block: fix uint32 overflow (2024-09-17 12:12:30 +0200)
 ----------------------------------------------------------------
 Pull request
-The main fix here is for io_uring. Spurious -EAGAIN errors can happen and the
+An integer overflow fix for the last zone on a zoned block device whose
-request needs to be resubmitted.
+capacity is not a multiple of the zone size.
 The MAINTAINERS changes carry no risk and we might as well include them in QEMU
 .1.
 ----------------------------------------------------------------
-Fabian Ebner (1):
+Dmitry Frolov (1):
-  block/io_uring: resubmit when result is -EAGAIN
+  hw/block: fix uint32 overflow
-Philippe Mathieu-Daudé (1):
+ hw/block/virtio-blk.c | 2 +-
-  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver
+file changed, 1 insertion(+), 1 deletion(-)
 Stefano Garzarella (1):
   MAINTAINERS: add Stefano Garzarella as io_uring reviewer
  MAINTAINERS      |  2 ++
  block/io_uring.c | 16 +++++++++++++++-
 files changed, 17 insertions(+), 1 deletion(-)
 --
-.31.1
+.46.0

-[PULL for-6.1 1/3] MAINTAINERS: add Stefano Garzarella as io_uring reviewer
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-I've been working with io_uring for a while so I'd like to help
-with reviews.
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-Id: <20210728131515.131045-1-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- MAINTAINERS | 1 +
-file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ Linux io_uring
- M: Aarushi Mehta <mehta.aaru20@gmail.com>
- M: Julia Suvorova <jusual@redhat.com>
- M: Stefan Hajnoczi <stefanha@redhat.com>
-+R: Stefano Garzarella <sgarzare@redhat.com>
- L: qemu-block@nongnu.org
- S: Maintained
- F: block/io_uring.c
---
-.31.1

-[PULL for-6.1 2/3] block/io_uring: resubmit when result is -EAGAIN
+Deleted patch
-From: Fabian Ebner <f.ebner@proxmox.com>
-Linux SCSI can throw spurious -EAGAIN in some corner cases in its
-completion path, which will end up being the result in the completed
-io_uring request.
-Resubmitting such requests should allow block jobs to complete, even
-if such spurious errors are encountered.
-Co-authored-by: Stefan Hajnoczi <stefanha@gmail.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
-Message-id: 20210729091029.65369-1-f.ebner@proxmox.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/io_uring.c | 16 +++++++++++++++-
-file changed, 15 insertions(+), 1 deletion(-)
-diff --git a/block/io_uring.c b/block/io_uring.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io_uring.c
-+++ b/block/io_uring.c
-@@ -XXX,XX +XXX,XX @@ static void luring_process_completions(LuringState *s)
-         total_bytes = ret + luringcb->total_read;
-         if (ret < 0) {
--            if (ret == -EINTR) {
-+            /*
-+             * Only writev/readv/fsync requests on regular files or host block
-+             * devices are submitted. Therefore -EAGAIN is not expected but it's
-+             * known to happen sometimes with Linux SCSI. Submit again and hope
-+             * the request completes successfully.
-+             *
-+             * For more information, see:
-+             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
-+             *
-+             * If the code is changed to submit other types of requests in the
-+             * future, then this workaround may need to be extended to deal with
-+             * genuine -EAGAIN results that should not be resubmitted
-+             * immediately.
-+             */
-+            if (ret == -EINTR || ret == -EAGAIN) {
-                 luring_resubmit(s, luringcb);
-                 continue;
-             }
---
-.31.1

-[PULL for-6.1 3/3] MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver
+[PULL 1/1] hw/block: fix uint32 overflow
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Dmitry Frolov <frolov@swemel.ru>
-I'm interested in following the activity around the NVMe bdrv.
+The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow
 uint32.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
-Message-id: 20210728183340.2018313-1-philmd@redhat.com
 Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
 Message-id: 20240917080356.270576-2-frolov@swemel.ru
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- MAINTAINERS | 1 +
+ hw/block/virtio-blk.c | 2 +-
-file changed, 1 insertion(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/block/virtio-blk.c
-+++ b/MAINTAINERS
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ F: block/null.c
+@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op)
- NVMe Block Driver
+     } else {
- M: Stefan Hajnoczi <stefanha@redhat.com>
+         if (bs->bl.zone_size > capacity - offset) {
- R: Fam Zheng <fam@euphon.net>
+             /* The zoned device allows the last smaller zone. */
-+R: Philippe Mathieu-Daudé <philmd@redhat.com>
+-            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1);
- L: qemu-block@nongnu.org
++            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1ull);
- S: Supported
+         } else {
- F: block/nvme*
+             len = bs->bl.zone_size;
          }
 --
-.31.1
+.46.0

The following changes since commit 3521ade3510eb5cefb2e27a101667f25dad89935:

Merge remote-tracking branch 'remotes/thuth-gitlab/tags/pull-request-2021-07-29' into staging (2021-07-29 13:17:20 +0100)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to cc8eecd7f105a1dff5876adeb238a14696061a4a:

MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver (2021-07-29 17:17:34 +0100)

----------------------------------------------------------------
Pull request

The main fix here is for io_uring. Spurious -EAGAIN errors can happen and the
request needs to be resubmitted.

The MAINTAINERS changes carry no risk and we might as well include them in QEMU
6.1.

----------------------------------------------------------------

Fabian Ebner (1):
  block/io_uring: resubmit when result is -EAGAIN

Philippe Mathieu-Daudé (1):
  MAINTAINERS: Added myself as a reviewer for the NVMe Block Driver

Stefano Garzarella (1):
  MAINTAINERS: add Stefano Garzarella as io_uring reviewer

MAINTAINERS      |  2 ++
 block/io_uring.c | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

-- 
2.31.1

From: Fabian Ebner <f.ebner@proxmox.com>

Linux SCSI can throw spurious -EAGAIN in some corner cases in its
completion path, which will end up being the result in the completed
io_uring request.

Resubmitting such requests should allow block jobs to complete, even
if such spurious errors are encountered.

Co-authored-by: Stefan Hajnoczi <stefanha@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
Message-id: 20210729091029.65369-1-f.ebner@proxmox.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io_uring.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/block/io_uring.c b/block/io_uring.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io_uring.c
+++ b/block/io_uring.c
@@ -XXX,XX +XXX,XX @@ static void luring_process_completions(LuringState *s)
         total_bytes = ret + luringcb->total_read;
 
         if (ret < 0) {
-            if (ret == -EINTR) {
+            /*
+             * Only writev/readv/fsync requests on regular files or host block
+             * devices are submitted. Therefore -EAGAIN is not expected but it's
+             * known to happen sometimes with Linux SCSI. Submit again and hope
+             * the request completes successfully.
+             *
+             * For more information, see:
+             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
+             *
+             * If the code is changed to submit other types of requests in the
+             * future, then this workaround may need to be extended to deal with
+             * genuine -EAGAIN results that should not be resubmitted
+             * immediately.
+             */
+            if (ret == -EINTR || ret == -EAGAIN) {
                 luring_resubmit(s, luringcb);
                 continue;
             }
-- 
2.31.1

From: Dmitry Frolov <frolov@swemel.ru>

The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow
uint32.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-id: 20240917080356.270576-2-frolov@swemel.ru
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op)
     } else {
         if (bs->bl.zone_size > capacity - offset) {
             /* The zoned device allows the last smaller zone. */
-            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1);
+            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1ull);
         } else {
             len = bs->bl.zone_size;
         }
-- 
2.46.0