aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2010-05-19 20:53:10 +0200
committerDoug Goldstein <cardoe@gentoo.org>2010-07-20 17:28:17 -0500
commitfb0bd59720c4010f9dd5fb7627ed3bc3d137b25d (patch)
tree9ba12b8fd344b0c4a76306e2292e8c2decf0fa15
parentpci: irq_state vmstate breakage (diff)
downloadqemu-kvm-fb0bd59720c4010f9dd5fb7627ed3bc3d137b25d.tar.gz
qemu-kvm-fb0bd59720c4010f9dd5fb7627ed3bc3d137b25d.tar.bz2
qemu-kvm-fb0bd59720c4010f9dd5fb7627ed3bc3d137b25d.zip
block: fix sector comparism in multiwrite_req_compare
The difference between the start sectors of two requests can be larger than the size of the "int" type, which can lead to a not correctly sorted multiwrite array and thus spurious I/O errors and filesystem corruption due to incorrect request merges. So instead of doing the cute sector arithmetics trick spell out the exact comparisms. Spotted by Kevin Wolf based on a testcase from Michael Tokarev. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 77be4366baface6613cfc312ba281f8e5860997c)
-rw-r--r--block.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/block.c b/block.c
index 7326bfeee..955eeaa7b 100644
--- a/block.c
+++ b/block.c
@@ -1636,7 +1636,19 @@ static void multiwrite_cb(void *opaque, int ret)
static int multiwrite_req_compare(const void *a, const void *b)
{
- return (((BlockRequest*) a)->sector - ((BlockRequest*) b)->sector);
+ const BlockRequest *req1 = a, *req2 = b;
+
+ /*
+ * Note that we can't simply subtract req2->sector from req1->sector
+ * here as that could overflow the return value.
+ */
+ if (req1->sector > req2->sector) {
+ return 1;
+ } else if (req1->sector < req2->sector) {
+ return -1;
+ } else {
+ return 0;
+ }
}
/*