mirror: Fix qiov size for short requests

When mirroring an image of a size that is not a multiple of the
mirror job granularity, the last request would have the right nb_sectors
argument, but a qiov that is rounded up to the next multiple of the
granularity. Don't do this.

This fixes a segfault that is caused by raw-posix being confused by this
and allocating a buffer with request length, but operating on it with
qiov length.

[s/Driver/Drive/ in qemu-iotests 041 as suggested by Eric
--Stefan]

Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 5a0f6fd5c84573387056e0464a7fc0c6fb70b2dc)

Conflicts:
	tests/qemu-iotests/041.out

*updated 041.out to reflect tests missing from 2.0

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

diff --git a/block/mirror.c b/block/mirror.c
index 21f2d8dcfdbbb93b877970933801c75e79155ac0..6e502e3f213c4835cb2fabe71ba1c0ba7da9f463 100644 (file)
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -259,9 +259,11 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
     next_sector = sector_num;
     while (nb_chunks-- > 0) {
         MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
+        size_t remaining = (nb_sectors * BDRV_SECTOR_SIZE) - op->qiov.size;
+
         QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
         s->buf_free_count--;
-        qemu_iovec_add(&op->qiov, buf, s->granularity);
+        qemu_iovec_add(&op->qiov, buf, MIN(s->granularity, remaining));
 
         /* Advance the HBitmapIter in parallel, so that we do not examine
          * the same sector twice.

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index ef4f4657cc714ad8eb7d346df365d71c657f9ff8..ef74be63ec2743a8ac7b37b04f728fece2207fe5 100755 (executable)
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -211,6 +211,11 @@ class TestSingleDriveZeroLength(TestSingleDrive):
     test_small_buffer2 = None
     test_large_cluster = None
 
+class TestSingleDriveUnalignedLength(TestSingleDrive):
+    image_len = 1025 * 1024
+    test_small_buffer2 = None
+    test_large_cluster = None
+
 class TestMirrorNoBacking(ImageMirroringTestCase):
     image_len = 2 * 1024 * 1024 # MB
 

diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out
index cfa5c0d0e667ce3a4623db0da9fbfabb0fb63d1c..802ffaa0c09329cdd68d8db15b8cd611b43ca9ee 100644 (file)
--- a/tests/qemu-iotests/041.out
+++ b/tests/qemu-iotests/041.out
@@ -1,5 +1,5 @@
-...................................
+...........................................
 ----------------------------------------------------------------------
-Ran 35 tests
+Ran 43 tests
 
 OK