Commit fa21e6fa authored by Denis V. Lunev's avatar Denis V. Lunev Committed by Kevin Wolf
Browse files

nbd: fix max_discard/max_transfer_length 



nbd_co_discard calls nbd_client_session_co_discard which uses uint32_t
as the length in bytes of the data to discard due to the following
definition:

struct nbd_request {
    uint32_t magic;
    uint32_t type;
    uint64_t handle;
    uint64_t from;
    uint32_t len; <-- the length of data to be discarded, in bytes
} QEMU_PACKED;

Thus we should limit bl_max_discard to UINT32_MAX >> BDRV_SECTOR_BITS to
avoid overflow.

NBD read/write code uses the same structure for transfers. Fix
max_transfer_length accordingly.

Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
CC: Peter Lieven <pl@kamp.de>
CC: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent 75af1f34

block/nbd.c

+9 −0
Original line number Diff line number Diff line
@@ -301,6 +301,12 @@ static int nbd_co_flush(BlockDriverState *bs) 
    return nbd_client_session_co_flush(&s->client);

}



static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)

{

    bs->bl.max_discard = UINT32_MAX >> BDRV_SECTOR_BITS;

    bs->bl.max_transfer_length = UINT32_MAX >> BDRV_SECTOR_BITS;

}



static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,

                          int nb_sectors)

{
@@ -396,6 +402,7 @@ static BlockDriver bdrv_nbd = { 
    .bdrv_close                 = nbd_close,

    .bdrv_co_flush_to_os        = nbd_co_flush,

    .bdrv_co_discard            = nbd_co_discard,

    .bdrv_refresh_limits        = nbd_refresh_limits,

    .bdrv_getlength             = nbd_getlength,

    .bdrv_detach_aio_context    = nbd_detach_aio_context,

    .bdrv_attach_aio_context    = nbd_attach_aio_context,
@@ -413,6 +420,7 @@ static BlockDriver bdrv_nbd_tcp = { 
    .bdrv_close                 = nbd_close,

    .bdrv_co_flush_to_os        = nbd_co_flush,

    .bdrv_co_discard            = nbd_co_discard,

    .bdrv_refresh_limits        = nbd_refresh_limits,

    .bdrv_getlength             = nbd_getlength,

    .bdrv_detach_aio_context    = nbd_detach_aio_context,

    .bdrv_attach_aio_context    = nbd_attach_aio_context,
@@ -430,6 +438,7 @@ static BlockDriver bdrv_nbd_unix = { 
    .bdrv_close                 = nbd_close,

    .bdrv_co_flush_to_os        = nbd_co_flush,

    .bdrv_co_discard            = nbd_co_discard,

    .bdrv_refresh_limits        = nbd_refresh_limits,

    .bdrv_getlength             = nbd_getlength,

    .bdrv_detach_aio_context    = nbd_detach_aio_context,

    .bdrv_attach_aio_context    = nbd_attach_aio_context,