From 7650496f160a2c7062b1eb1d17607d7e535fab94 Mon Sep 17 00:00:00 2001
From: aliguori <aliguori>
Date: Sun, 5 Apr 2009 17:40:38 +0000
Subject: [PATCH 03/11] Fix (at least one cause of) qcow2 corruption. (Nolan Leake)

qcow2's get_cluster_offset() scans forward in the l2 table to find other
clusters that have the same allocation status as the first cluster.
This is used by (among others) qcow_is_allocated().

Unfortunately, it was not checking to be sure that it didn't fall off
the end of the l2 table.  This patch adds that check.

The symptom that motivated me to look into this was that
bdrv_is_allocated() was returning false when there was in fact data
there.  This is one of many ways this bug could lead to data corruption.

I checked the other place that scans for consecutive unallocated blocks
(alloc_cluster_offset()) and it appears to be OK:
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
appears to prevent the same problem from occurring.

(cherry picked from commit a9341da30e0d465f5f348004af63995f6b19c2fa)

Signed-off-by: Nolan Leake <nolan <at> sigbus.net>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-ID: <20090407205832.GA12134@blackpad>
RH-Upstream-status: applied(kvm/master)
Acked-by: Avi Kivity <avi@redhat.com>
Acked-by: Zachary Amsden <zamsden@redhat.com>
Acked-by: Gleb Natapov <gleb@redhat.com>
Bugzilla: 497886
---
 qemu/block-qcow2.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/qemu/block-qcow2.c b/qemu/block-qcow2.c
index 35d17e3..e9df43a 100644
--- a/qemu/block-qcow2.c
+++ b/qemu/block-qcow2.c
@@ -786,6 +786,10 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
 
     nb_available = (nb_available >> 9) + index_in_cluster;
 
+    if (nb_needed > nb_available) {
+        nb_needed = nb_available;
+    }
+
     cluster_offset = 0;
 
     /* seek the the l2 offset in the l1 table */
-- 
1.6.1