diff options
| author | Peter Lieven <pl@kamp.de> | 2017-01-16 16:17:12 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2017-01-27 18:07:31 +0100 |
| commit | 1da45e0c4cf4719fa75898d019e0874b9b2bc774 (patch) | |
| tree | dfc9aa1b87b65e1bb9c4b8ad1649ec988fb89891 | |
| parent | b8bab8eb6934cbf6577a18a9c5657d7707379ac0 (diff) | |
block/iscsi: avoid data corruption with cache=writeback
nb_cls_shrunk in iscsi_allocmap_update can become -1 if the
request starts and ends within the same cluster. This results
in passing -1 to bitmap_set and bitmap_clear and they don't
handle negative values properly. In the end this leads to data
corruption.
Fixes: e1123a3b40a1a9a625a29c8ed4debb7e206ea690
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Lieven <pl@kamp.de>
Message-Id: <1484579832-18589-1-git-send-email-pl@kamp.de>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | block/iscsi.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/block/iscsi.c b/block/iscsi.c index 6aeeb9ec4f..1860f1bc91 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -499,14 +499,18 @@ iscsi_allocmap_update(IscsiLun *iscsilun, int64_t sector_num, if (allocated) { bitmap_set(iscsilun->allocmap, cl_num_expanded, nb_cls_expanded); } else { - bitmap_clear(iscsilun->allocmap, cl_num_shrunk, nb_cls_shrunk); + if (nb_cls_shrunk > 0) { + bitmap_clear(iscsilun->allocmap, cl_num_shrunk, nb_cls_shrunk); + } } if (iscsilun->allocmap_valid == NULL) { return; } if (valid) { - bitmap_set(iscsilun->allocmap_valid, cl_num_shrunk, nb_cls_shrunk); + if (nb_cls_shrunk > 0) { + bitmap_set(iscsilun->allocmap_valid, cl_num_shrunk, nb_cls_shrunk); + } } else { bitmap_clear(iscsilun->allocmap_valid, cl_num_expanded, nb_cls_expanded); |