18.09.2019 23:14, John Snow wrote: > > > On 9/17/19 12:07 PM, Vladimir Sementsov-Ogievskiy wrote: >> We shouldn't try to copy bytes beyond EOF. Fix it. >> >> Fixes: 9ded4a0114968e >> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@virtuozzo.com> >> Reviewed-by: Max Reitz <mre...@redhat.com> >> --- >> block/backup.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/block/backup.c b/block/backup.c >> index d8fdbfadfe..89f7f89200 100644 >> --- a/block/backup.c >> +++ b/block/backup.c >> @@ -161,7 +161,7 @@ static int coroutine_fn >> backup_cow_with_offload(BackupBlockJob *job, >> assert(QEMU_IS_ALIGNED(job->copy_range_size, job->cluster_size)); >> assert(QEMU_IS_ALIGNED(start, job->cluster_size)); >> - nbytes = MIN(job->copy_range_size, end - start); >> + nbytes = MIN(job->copy_range_size, MIN(end, job->len) - start); > > I'm a little confused. I think the patch as written is correct, but I don't > know what problem it solves.
last cluster may exceed EOF. And backup_do_cow (who calls backup_cow_with_offload) rounds all to clusters. It's not bad, but we need to crop nbytes before calling actual io functions. backup_cow_with_bounce_buffer does the same thing. > > If we're going to allow the caller to pass in an end that's beyond EOF, does > that mean we are *requiring* the caller to pass in a value that's aligned? Actually yes, as we are resetting dirty bitmap. > > We should probably assert what kind of a value we're accepted here, right? We > do for start, but should we for 'end' as well? Yes assertion may be added. > > Then ... > >> nr_clusters = DIV_ROUND_UP(nbytes, job->cluster_size); > > Don't we just round this right back up immediately anyway? Does that mean we > have callers that are passing in an 'end' that's more than 1 job-cluster > beyond EOF? That seems like something that should be fixed in the caller, > surely? nr_clusters are used to set/reset dirty bitmap. It's OK. Still, for last cluster we can drop it and use nbytes directly. No there should not be such callers. nbytes is used to call blk_co_copy_range, and must be cropped to not exceed EOF. Also, backup_cow_with_bounce_buffer behave in similar way: it crops nbytes. Of course, there is a place for good refactoring, but I think not in this patch, it's a small bug fix. > >> bdrv_reset_dirty_bitmap(job->copy_bitmap, start, >> job->cluster_size * nr_clusters); >> > -- Best regards, Vladimir