From 58cb4d8c3c6701294fc4dabec19229358d7fbc80 Mon Sep 17 00:00:00 2001 From: Gleb Natapov <gleb@redhat.com> Date: Sun, 10 May 2009 16:03:52 +0300 Subject: [PATCH 05/16] Fix cluster freeing in qcow2 Upstream commit d4d698f020e50333d6eae48ce323752613b5c3ea BZ: 500051 Need to drop QCOW_OFLAG_COPIED from a cluster pointer before freeing it. Add an explanation how thing meant to work. Signed-off-by: Gleb Natapov <gleb@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Bugzilla: 501729 Message-ID: <20090510130352.GF18554@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Acked-by: Andrea Arcangeli <aarcange@redhat.com> RH-Upstream-status: applied(kvm/master) Acked-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Dor Laor <dlaor@redhat.com> --- qemu/block-qcow2.c | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/qemu/block-qcow2.c b/qemu/block-qcow2.c index 8ec2d87..a8e9e8e 100644 --- a/qemu/block-qcow2.c +++ b/qemu/block-qcow2.c @@ -1020,6 +1020,12 @@ static int alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset, goto err; for (i = 0; i < m->nb_clusters; i++) { + /* if two concurrent writes happen to the same unallocated cluster + * each write allocates separate cluster and writes data concurrently. + * The first one to complete updates l2 table with pointer to its + * cluster the second one has to do RMW (which is done above by + * copy_sectors()), update l2 table with its cluster pointer and free + * old cluster. This is what this loop does */ if(l2_table[l2_index + i] != 0) old_cluster[j++] = l2_table[l2_index + i]; @@ -1033,7 +1039,8 @@ static int alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset, goto err; for (i = 0; i < j; i++) - free_any_clusters(bs, be64_to_cpu(old_cluster[i]), 1); + free_any_clusters(bs, be64_to_cpu(old_cluster[i]) & ~QCOW_OFLAG_COPIED, + 1); ret = 0; err: -- 1.6.3.rc4.29.g8146