On Mon, 04/27 15:23, Paolo Bonzini wrote: > > > On 27/04/2015 15:18, Fam Zheng wrote: > > An unaligned zero write causes NULL deferencing in bdrv_co_do_pwritev. That > > path is reachable from bdrv_co_write_zeroes and bdrv_aio_write_zeroes. > > > > You can easily trigger through the former with qemu-io, as the test case > > added > > by 61815d6e0aa. For bdrv_aio_write_zeroes, in common cases there's always a > > format driver (which uses 512 alignment), so it would be much rarer to have > > unaligned requests (only concerning top level here, when the request goes > > down > > to bs->file, where for example the alignment is 4k, it would then be calling > > bdrv_co_write_zeroes because it's in a coroutine). > > > > fc3959e4669a1c fixed bdrv_co_write_zeroes but not bdrv_aio_write_zeroes. > > The > > lattern is the actually used one by device model. Revert the previous fix, > > do > > it in bdrv_co_do_pwritev, to cover both paths. > > > > v4: "if (!qiov)" -> "if (!qiov && bytes >= align)". (Paolo) > > > > v3: Fix the case where the unaligned request is contained within the first > > block. (Paolo) > > Also update iotests 033 to cover the code path with qemu-io. > > > > v2: Split to three aligned pwritev. > > > > > > Fam Zheng (3): > > Revert "block: Fix unaligned zero write" > > block: Fix NULL deference for unaligned write if qiov is NULL > > qemu-iotests: Test unaligned sub-block zero write > > > > block.c | 123 > > +++++++++++++++++++++++++-------------------- > > tests/qemu-iotests/033 | 13 +++++ > > tests/qemu-iotests/033.out | 30 +++++++++++ > > 3 files changed, 111 insertions(+), 55 deletions(-) > > > > Reviewed-by: Paolo Bonzini <pbonz...@redhat.com> >
Thanks very much for your attentive reviewing! Fam
