For zero write, qiov passed by callers (qemu-io "write -z" and scsi-disk
"write same") is NULL.
Commit fc3959e466 fixed bdrv_co_write_zeroes which is the common case
for this bug, but it still exists in bdrv_aio_write_zeroes. A simpler
fix would be in bdrv_co_do_pwritev which is the NULL dereference point
and covers both cases.
So don't access it in bdrv_co_do_pwritev in this case, use three aligned
writes.
Signed-off-by: Fam Zheng <f...@redhat.com>
---
block/io.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 63 insertions(+), 17 deletions(-)
diff --git a/block/io.c b/block/io.c
index 4e5a92e..b4b587d 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1214,6 +1214,8 @@ static int coroutine_fn
bdrv_co_do_pwritev(BlockDriverState *bs,
*/
tracked_request_begin(&req, bs, offset, bytes, true);
+ assert(qiov || flags & BDRV_REQ_ZERO_WRITE);
+
if (offset & (align - 1)) {
QEMUIOVector head_qiov;
struct iovec head_iov;
@@ -1236,13 +1238,39 @@ static int coroutine_fn
bdrv_co_do_pwritev(BlockDriverState *bs,
}
BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
- qemu_iovec_init(&local_qiov, qiov->niov + 2);
- qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1));
- qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
- use_local_qiov = true;
+ if (qiov) {
+ qemu_iovec_init(&local_qiov, qiov ? qiov->niov + 2 : 1);
+ qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1));
+ qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
+ use_local_qiov = true;
+ bytes += offset & (align - 1);
+ offset = offset & ~(align - 1);
+ } else {
+ uint64_t local_off = offset & (align - 1);
+ uint64_t local_bytes = MIN(bytes, align - local_off);
- bytes += offset & (align - 1);
- offset = offset & ~(align - 1);
+ memset(head_buf + local_off, 0, local_bytes);
+ ret = bdrv_aligned_pwritev(bs, &req, offset & ~(align - 1), align,
+ &head_qiov, 0);
+ if (ret < 0) {
+ goto fail;
+ }
+ bytes -= local_bytes;
+ offset = ROUND_UP(offset, align);
+ }
+ }
+
+ if (!qiov && bytes >= align) {
+ uint64_t aligned_bytes = bytes & ~(align - 1);
+
+ assert((offset & (align - 1)) == 0);
+ ret = bdrv_aligned_pwritev(bs, &req, offset, aligned_bytes,
+ NULL, flags);
+ if (ret < 0) {
+ goto fail;
+ }
+ bytes -= aligned_bytes;
+ offset += aligned_bytes;
}
if ((offset + bytes) & (align - 1)) {
@@ -1270,21 +1298,39 @@ static int coroutine_fn
bdrv_co_do_pwritev(BlockDriverState *bs,
}
BLKDBG_EVENT(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
- if (!use_local_qiov) {
- qemu_iovec_init(&local_qiov, qiov->niov + 1);
- qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
- use_local_qiov = true;
+ if (qiov) {
+ if (!use_local_qiov) {
+ qemu_iovec_init(&local_qiov, qiov->niov + 1);
+ qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
+ use_local_qiov = true;
+ }
+
+ tail_bytes = (offset + bytes) & (align - 1);
+ qemu_iovec_add(&local_qiov, tail_buf + tail_bytes,
+ align - tail_bytes);
+
+ bytes = ROUND_UP(bytes, align);
+ } else {
+ assert((offset & (align - 1)) == 0);
+ assert(bytes < align);
+
+ memset(tail_buf, 0, bytes & (align - 1));
+ ret = bdrv_aligned_pwritev(bs, &req, offset, align,
+ &tail_qiov, 0);
+ if (ret < 0) {
+ goto fail;
+ }
+ offset += align;
+ bytes = 0;
}
- tail_bytes = (offset + bytes) & (align - 1);
- qemu_iovec_add(&local_qiov, tail_buf + tail_bytes, align - tail_bytes);
-
- bytes = ROUND_UP(bytes, align);
}
- ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
- use_local_qiov ? &local_qiov : qiov,
- flags);
+ if (bytes) {
+ ret = bdrv_aligned_pwritev(bs, &req, offset, bytes,
+ use_local_qiov ? &local_qiov : qiov,
+ flags);
+ }
fail:
tracked_request_end(&req);
--
1.9.3
