From 3f6a3ee51ebd1e86c48ff1216f5caf9785913ab5 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Tue, 7 Jul 2009 18:09:42 +0200 Subject: [PATCH] qcow2: Fix L1 table memory allocation Contrary to what one could expect, the size of L1 tables is not cluster aligned. So as we're writing whole sectors now instead of single entries, we need to ensure that the L1 table in memory is large enough; otherwise write would access memory after the end of the L1 table. Signed-off-by: Kevin Wolf Signed-off-by: Anthony Liguori --- block/qcow2-cluster.c | 2 +- block/qcow2-refcount.c | 2 +- block/qcow2.c | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index d349655d0c..057dac5738 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -47,7 +47,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size) #endif new_l1_size2 = sizeof(uint64_t) * new_l1_size; - new_l1_table = qemu_mallocz(new_l1_size2); + new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512)); memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t)); /* write new table (align to cluster) */ diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index d42c6e6461..e6c857e084 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -513,7 +513,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs, l1_size2 = l1_size * sizeof(uint64_t); l1_allocated = 0; if (l1_table_offset != s->l1_table_offset) { - l1_table = qemu_malloc(l1_size2); + l1_table = qemu_mallocz(align_offset(l1_size2, 512)); l1_allocated = 1; if (bdrv_pread(s->hd, l1_table_offset, l1_table, l1_size2) != l1_size2) diff --git a/block/qcow2.c b/block/qcow2.c index 9a7c666ee7..be507e7a9c 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -200,7 +200,8 @@ static int qcow_open(BlockDriverState *bs, const char *filename, int flags) if (s->l1_size < s->l1_vm_state_index) goto fail; s->l1_table_offset = header.l1_table_offset; - s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t)); + s->l1_table = qemu_mallocz( + align_offset(s->l1_size * sizeof(uint64_t), 512)); if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) != s->l1_size * sizeof(uint64_t)) goto fail; -- 2.11.0