| 1 | The following changes since commit 59084feb256c617063e0dbe7e64821ae8852d7cf: | 1 | The following changes since commit 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56: |
|---|---|---|---|
| 2 | 2 | ||
| 3 | Merge tag 'pull-aspeed-20240709' of https://github.com/legoater/qemu into staging (2024-07-09 07:13:55 -0700) | 3 | scripts/checkpatch: Fix a typo (2025-03-04 09:30:26 +0800) |
| 4 | 4 | ||
| 5 | are available in the Git repository at: | 5 | are available in the Git repository at: |
| 6 | 6 | ||
| 7 | https://gitlab.com/stefanha/qemu.git tags/block-pull-request | 7 | https://gitlab.com/stefanha/qemu.git tags/block-pull-request |
| 8 | 8 | ||
| 9 | for you to fetch changes up to d05ae948cc887054495977855b0859d0d4ab2613: | 9 | for you to fetch changes up to 2ad638a3d160923ef3dbf87c73944e6e44bdc724: |
| 10 | 10 | ||
| 11 | Consider discard option when writing zeros (2024-07-11 11:06:36 +0200) | 11 | block/qed: fix use-after-free by nullifying timer pointer after free (2025-03-06 10:19:54 +0800) |
| 12 | 12 | ||
| 13 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
| 14 | Pull request | 14 | Pull request |
| 15 | 15 | ||
| 16 | A discard fix from Nir Soffer. | 16 | QED need_check_timer use-after-free fix |
| 17 | 17 | ||
| 18 | ---------------------------------------------------------------- | 18 | ---------------------------------------------------------------- |
| 19 | 19 | ||
| 20 | Nir Soffer (2): | 20 | Denis Rastyogin (1): |
| 21 | qemu-iotest/245: Add missing discard=unmap | 21 | block/qed: fix use-after-free by nullifying timer pointer after free |
| 22 | Consider discard option when writing zeros | ||
| 23 | 22 | ||
| 24 | block/io.c | 9 +- | 23 | block/qed.c | 1 + |
| 25 | tests/qemu-iotests/245 | 2 +- | 24 | 1 file changed, 1 insertion(+) |
| 26 | tests/qemu-iotests/tests/write-zeroes-unmap | 127 ++++++++++++++++++ | ||
| 27 | .../qemu-iotests/tests/write-zeroes-unmap.out | 81 +++++++++++ | ||
| 28 | 4 files changed, 214 insertions(+), 5 deletions(-) | ||
| 29 | create mode 100755 tests/qemu-iotests/tests/write-zeroes-unmap | ||
| 30 | create mode 100644 tests/qemu-iotests/tests/write-zeroes-unmap.out | ||
| 31 | 25 | ||
| 32 | -- | 26 | -- |
| 33 | 2.45.2 | 27 | 2.48.1 | diff view generated by jsdifflib |
Deleted patch | |||
|---|---|---|---|
| 1 | From: Nir Soffer <nsoffer@redhat.com> | ||
| 2 | 1 | ||
| 3 | The test works since we punch holes by default even when opening the | ||
| 4 | image without discard=on or discard=unmap. Fix the test to enable | ||
| 5 | discard. | ||
| 6 | |||
| 7 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
| 8 | --- | ||
| 9 | tests/qemu-iotests/245 | 2 +- | ||
| 10 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 11 | |||
| 12 | diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245 | ||
| 13 | index XXXXXXX..XXXXXXX 100755 | ||
| 14 | --- a/tests/qemu-iotests/245 | ||
| 15 | +++ b/tests/qemu-iotests/245 | ||
| 16 | @@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase): | ||
| 17 | @iotests.skip_if_unsupported(['compress']) | ||
| 18 | def test_insert_compress_filter(self): | ||
| 19 | # Add an image to the VM: hd (raw) -> hd0 (qcow2) -> hd0-file (file) | ||
| 20 | - opts = {'driver': 'raw', 'node-name': 'hd', 'file': hd_opts(0)} | ||
| 21 | + opts = {'driver': 'raw', 'node-name': 'hd', 'file': hd_opts(0), 'discard': 'unmap'} | ||
| 22 | self.vm.cmd('blockdev-add', conv_keys = False, **opts) | ||
| 23 | |||
| 24 | # Add a 'compress' filter | ||
| 25 | -- | ||
| 26 | 2.45.2 | diff view generated by jsdifflib |
| 1 | From: Nir Soffer <nsoffer@redhat.com> | 1 | From: Denis Rastyogin <gerben@altlinux.org> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | When opening an image with discard=off, we punch hole in the image when | 3 | This error was discovered by fuzzing qemu-img. |
| 4 | writing zeroes, making the image sparse. This breaks users that want to | ||
| 5 | ensure that writes cannot fail with ENOSPACE by using fully allocated | ||
| 6 | images[1]. | ||
| 7 | 4 | ||
| 8 | bdrv_co_pwrite_zeroes() correctly disables BDRV_REQ_MAY_UNMAP if we | 5 | In the QED block driver, the need_check_timer timer is freed in |
| 9 | opened the child without discard=unmap or discard=on. But we don't go | 6 | bdrv_qed_detach_aio_context, but the pointer to the timer is not |
| 10 | through this function when accessing the top node. Move the check down | 7 | set to NULL. This can lead to a use-after-free scenario |
| 11 | to bdrv_co_do_pwrite_zeroes() which seems to be used in all code paths. | 8 | in bdrv_qed_drain_begin(). |
| 12 | 9 | ||
| 13 | This change implements the documented behavior, punching holes only when | 10 | The need_check_timer pointer is set to NULL after freeing the timer. |
| 14 | opening the image with discard=on or discard=unmap. This may not be the | 11 | Which helps catch this condition when checking in bdrv_qed_drain_begin(). |
| 15 | best default but can improve it later. | ||
| 16 | 12 | ||
| 17 | The test depends on a file system supporting discard, deallocating the | 13 | Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852 |
| 18 | entire file when punching hole with the length of the entire file. | 14 | Signed-off-by: Denis Rastyogin <gerben@altlinux.org> |
| 19 | Tested with xfs, ext4, and tmpfs. | 15 | Message-ID: <20250304083927.37681-1-gerben@altlinux.org> |
| 20 | |||
| 21 | [1] https://lists.nongnu.org/archive/html/qemu-discuss/2024-06/msg00003.html | ||
| 22 | |||
| 23 | Signed-off-by: Nir Soffer <nsoffer@redhat.com> | ||
| 24 | Message-id: 20240628202058.1964986-3-nsoffer@redhat.com | ||
| 25 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 16 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
| 26 | --- | 17 | --- |
| 27 | block/io.c | 9 +- | 18 | block/qed.c | 1 + |
| 28 | tests/qemu-iotests/tests/write-zeroes-unmap | 127 ++++++++++++++++++ | 19 | 1 file changed, 1 insertion(+) |
| 29 | .../qemu-iotests/tests/write-zeroes-unmap.out | 81 +++++++++++ | ||
| 30 | 3 files changed, 213 insertions(+), 4 deletions(-) | ||
| 31 | create mode 100755 tests/qemu-iotests/tests/write-zeroes-unmap | ||
| 32 | create mode 100644 tests/qemu-iotests/tests/write-zeroes-unmap.out | ||
| 33 | 20 | ||
| 34 | diff --git a/block/io.c b/block/io.c | 21 | diff --git a/block/qed.c b/block/qed.c |
| 35 | index XXXXXXX..XXXXXXX 100644 | 22 | index XXXXXXX..XXXXXXX 100644 |
| 36 | --- a/block/io.c | 23 | --- a/block/qed.c |
| 37 | +++ b/block/io.c | 24 | +++ b/block/qed.c |
| 38 | @@ -XXX,XX +XXX,XX @@ bdrv_co_do_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes, | 25 | @@ -XXX,XX +XXX,XX @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs) |
| 39 | return -EINVAL; | 26 | |
| 40 | } | 27 | qed_cancel_need_check_timer(s); |
| 41 | 28 | timer_free(s->need_check_timer); | |
| 42 | + /* If opened with discard=off we should never unmap. */ | 29 | + s->need_check_timer = NULL; |
| 43 | + if (!(bs->open_flags & BDRV_O_UNMAP)) { | ||
| 44 | + flags &= ~BDRV_REQ_MAY_UNMAP; | ||
| 45 | + } | ||
| 46 | + | ||
| 47 | /* Invalidate the cached block-status data range if this write overlaps */ | ||
| 48 | bdrv_bsc_invalidate_range(bs, offset, bytes); | ||
| 49 | |||
| 50 | @@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset, | ||
| 51 | trace_bdrv_co_pwrite_zeroes(child->bs, offset, bytes, flags); | ||
| 52 | assert_bdrv_graph_readable(); | ||
| 53 | |||
| 54 | - if (!(child->bs->open_flags & BDRV_O_UNMAP)) { | ||
| 55 | - flags &= ~BDRV_REQ_MAY_UNMAP; | ||
| 56 | - } | ||
| 57 | - | ||
| 58 | return bdrv_co_pwritev(child, offset, bytes, NULL, | ||
| 59 | BDRV_REQ_ZERO_WRITE | flags); | ||
| 60 | } | 30 | } |
| 61 | diff --git a/tests/qemu-iotests/tests/write-zeroes-unmap b/tests/qemu-iotests/tests/write-zeroes-unmap | 31 | |
| 62 | new file mode 100755 | 32 | static void bdrv_qed_attach_aio_context(BlockDriverState *bs, |
| 63 | index XXXXXXX..XXXXXXX | ||
| 64 | --- /dev/null | ||
| 65 | +++ b/tests/qemu-iotests/tests/write-zeroes-unmap | ||
| 66 | @@ -XXX,XX +XXX,XX @@ | ||
| 67 | +#!/usr/bin/env bash | ||
| 68 | +# group: quick | ||
| 69 | +# | ||
| 70 | +# Test write zeros unmap. | ||
| 71 | +# | ||
| 72 | +# Copyright (C) Red Hat, Inc. | ||
| 73 | +# | ||
| 74 | +# This program is free software; you can redistribute it and/or modify | ||
| 75 | +# it under the terms of the GNU General Public License as published by | ||
| 76 | +# the Free Software Foundation; either version 2 of the License, or | ||
| 77 | +# (at your option) any later version. | ||
| 78 | +# | ||
| 79 | +# This program is distributed in the hope that it will be useful, | ||
| 80 | +# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| 81 | +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| 82 | +# GNU General Public License for more details. | ||
| 83 | +# | ||
| 84 | +# You should have received a copy of the GNU General Public License | ||
| 85 | +# along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
| 86 | +# | ||
| 87 | + | ||
| 88 | +seq="$(basename $0)" | ||
| 89 | +echo "QA output created by $seq" | ||
| 90 | + | ||
| 91 | +trap _cleanup_test_img exit | ||
| 92 | + | ||
| 93 | +# get standard environment, filters and checks | ||
| 94 | +cd .. | ||
| 95 | +. ./common.rc | ||
| 96 | +. ./common.filter | ||
| 97 | + | ||
| 98 | +_supported_fmt raw | ||
| 99 | +_supported_proto file | ||
| 100 | +_supported_os Linux | ||
| 101 | + | ||
| 102 | +create_test_image() { | ||
| 103 | + _make_test_img -f $IMGFMT 1m | ||
| 104 | +} | ||
| 105 | + | ||
| 106 | +filter_command() { | ||
| 107 | + _filter_testdir | _filter_qemu_io | _filter_qemu | _filter_hmp | ||
| 108 | +} | ||
| 109 | + | ||
| 110 | +print_disk_usage() { | ||
| 111 | + du -sh $TEST_IMG | _filter_testdir | ||
| 112 | +} | ||
| 113 | + | ||
| 114 | +echo | ||
| 115 | +echo "=== defaults - write zeros ===" | ||
| 116 | +echo | ||
| 117 | + | ||
| 118 | +create_test_image | ||
| 119 | +echo -e 'qemu-io none0 "write -z 0 1m"\nquit' \ | ||
| 120 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT \ | ||
| 121 | + | filter_command | ||
| 122 | +print_disk_usage | ||
| 123 | + | ||
| 124 | +echo | ||
| 125 | +echo "=== defaults - write zeros unmap ===" | ||
| 126 | +echo | ||
| 127 | + | ||
| 128 | +create_test_image | ||
| 129 | +echo -e 'qemu-io none0 "write -zu 0 1m"\nquit' \ | ||
| 130 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT \ | ||
| 131 | + | filter_command | ||
| 132 | +print_disk_usage | ||
| 133 | + | ||
| 134 | + | ||
| 135 | +echo | ||
| 136 | +echo "=== defaults - write actual zeros ===" | ||
| 137 | +echo | ||
| 138 | + | ||
| 139 | +create_test_image | ||
| 140 | +echo -e 'qemu-io none0 "write -P 0 0 1m"\nquit' \ | ||
| 141 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT \ | ||
| 142 | + | filter_command | ||
| 143 | +print_disk_usage | ||
| 144 | + | ||
| 145 | +echo | ||
| 146 | +echo "=== discard=off - write zeroes unmap ===" | ||
| 147 | +echo | ||
| 148 | + | ||
| 149 | +create_test_image | ||
| 150 | +echo -e 'qemu-io none0 "write -zu 0 1m"\nquit' \ | ||
| 151 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT,discard=off \ | ||
| 152 | + | filter_command | ||
| 153 | +print_disk_usage | ||
| 154 | + | ||
| 155 | +echo | ||
| 156 | +echo "=== detect-zeroes=on - write actual zeros ===" | ||
| 157 | +echo | ||
| 158 | + | ||
| 159 | +create_test_image | ||
| 160 | +echo -e 'qemu-io none0 "write -P 0 0 1m"\nquit' \ | ||
| 161 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT,detect-zeroes=on \ | ||
| 162 | + | filter_command | ||
| 163 | +print_disk_usage | ||
| 164 | + | ||
| 165 | +echo | ||
| 166 | +echo "=== detect-zeroes=on,discard=on - write actual zeros ===" | ||
| 167 | +echo | ||
| 168 | + | ||
| 169 | +create_test_image | ||
| 170 | +echo -e 'qemu-io none0 "write -P 0 0 1m"\nquit' \ | ||
| 171 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT,detect-zeroes=on,discard=on \ | ||
| 172 | + | filter_command | ||
| 173 | +print_disk_usage | ||
| 174 | + | ||
| 175 | +echo | ||
| 176 | +echo "=== discard=on - write zeroes ===" | ||
| 177 | +echo | ||
| 178 | + | ||
| 179 | +create_test_image | ||
| 180 | +echo -e 'qemu-io none0 "write -z 0 1m"\nquit' \ | ||
| 181 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT,discard=on \ | ||
| 182 | + | filter_command | ||
| 183 | +print_disk_usage | ||
| 184 | + | ||
| 185 | +echo | ||
| 186 | +echo "=== discard=on - write zeroes unmap ===" | ||
| 187 | +echo | ||
| 188 | + | ||
| 189 | +create_test_image | ||
| 190 | +echo -e 'qemu-io none0 "write -zu 0 1m"\nquit' \ | ||
| 191 | + | $QEMU -monitor stdio -drive if=none,file=$TEST_IMG,format=$IMGFMT,discard=on \ | ||
| 192 | + | filter_command | ||
| 193 | +print_disk_usage | ||
| 194 | diff --git a/tests/qemu-iotests/tests/write-zeroes-unmap.out b/tests/qemu-iotests/tests/write-zeroes-unmap.out | ||
| 195 | new file mode 100644 | ||
| 196 | index XXXXXXX..XXXXXXX | ||
| 197 | --- /dev/null | ||
| 198 | +++ b/tests/qemu-iotests/tests/write-zeroes-unmap.out | ||
| 199 | @@ -XXX,XX +XXX,XX @@ | ||
| 200 | +QA output created by write-zeroes-unmap | ||
| 201 | + | ||
| 202 | +=== defaults - write zeros === | ||
| 203 | + | ||
| 204 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 205 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 206 | +(qemu) qemu-io none0 "write -z 0 1m" | ||
| 207 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 208 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 209 | +(qemu) quit | ||
| 210 | +1.0M TEST_DIR/t.raw | ||
| 211 | + | ||
| 212 | +=== defaults - write zeros unmap === | ||
| 213 | + | ||
| 214 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 215 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 216 | +(qemu) qemu-io none0 "write -zu 0 1m" | ||
| 217 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 218 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 219 | +(qemu) quit | ||
| 220 | +1.0M TEST_DIR/t.raw | ||
| 221 | + | ||
| 222 | +=== defaults - write actual zeros === | ||
| 223 | + | ||
| 224 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 225 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 226 | +(qemu) qemu-io none0 "write -P 0 0 1m" | ||
| 227 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 228 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 229 | +(qemu) quit | ||
| 230 | +1.0M TEST_DIR/t.raw | ||
| 231 | + | ||
| 232 | +=== discard=off - write zeroes unmap === | ||
| 233 | + | ||
| 234 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 235 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 236 | +(qemu) qemu-io none0 "write -zu 0 1m" | ||
| 237 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 238 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 239 | +(qemu) quit | ||
| 240 | +1.0M TEST_DIR/t.raw | ||
| 241 | + | ||
| 242 | +=== detect-zeroes=on - write actual zeros === | ||
| 243 | + | ||
| 244 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 245 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 246 | +(qemu) qemu-io none0 "write -P 0 0 1m" | ||
| 247 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 248 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 249 | +(qemu) quit | ||
| 250 | +1.0M TEST_DIR/t.raw | ||
| 251 | + | ||
| 252 | +=== detect-zeroes=on,discard=on - write actual zeros === | ||
| 253 | + | ||
| 254 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 255 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 256 | +(qemu) qemu-io none0 "write -P 0 0 1m" | ||
| 257 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 258 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 259 | +(qemu) quit | ||
| 260 | +1.0M TEST_DIR/t.raw | ||
| 261 | + | ||
| 262 | +=== discard=on - write zeroes === | ||
| 263 | + | ||
| 264 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 265 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 266 | +(qemu) qemu-io none0 "write -z 0 1m" | ||
| 267 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 268 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 269 | +(qemu) quit | ||
| 270 | +1.0M TEST_DIR/t.raw | ||
| 271 | + | ||
| 272 | +=== discard=on - write zeroes unmap === | ||
| 273 | + | ||
| 274 | +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 | ||
| 275 | +QEMU X.Y.Z monitor - type 'help' for more information | ||
| 276 | +(qemu) qemu-io none0 "write -zu 0 1m" | ||
| 277 | +wrote 1048576/1048576 bytes at offset 0 | ||
| 278 | +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
| 279 | +(qemu) quit | ||
| 280 | +0 TEST_DIR/t.raw | ||
| 281 | -- | 33 | -- |
| 282 | 2.45.2 | 34 | 2.48.1 | diff view generated by jsdifflib |