diff options
| author | Fam Zheng <famz@redhat.com> | 2015-05-06 20:23:46 +0800 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2015-05-22 17:08:00 +0200 |
| commit | 5e82a31eb967db135fc4e688b134fb0972d62de3 (patch) | |
| tree | b6f4c435fd3a659d2733d7dbcd1a477c50c17067 /block | |
| parent | aacd5650c68ef2e9e19079ba60cb0df51e15880c (diff) | |
| download | qemu-5e82a31eb967db135fc4e688b134fb0972d62de3.tar.gz | |
vmdk: Fix next_cluster_sector for compressed write
This fixes the bug introduced by commit c6ac36e (vmdk: Optimize cluster
allocation).
Sometimes, write_len could be larger than cluster size, because it
contains both data and marker. We must advance next_cluster_sector in
this case, otherwise the image gets corrupted.
Cc: qemu-stable@nongnu.org
Reported-by: Antoni Villalonga <qemu-list@friki.cat>
Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/vmdk.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/block/vmdk.c b/block/vmdk.c index 1c5e2ef1b3..4b4a862ecf 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -1302,6 +1302,8 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset, uLongf buf_len; const uint8_t *write_buf = buf; int write_len = nb_sectors * 512; + int64_t write_offset; + int64_t write_end_sector; if (extent->compressed) { if (!extent->has_marker) { @@ -1320,10 +1322,14 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset, write_buf = (uint8_t *)data; write_len = buf_len + sizeof(VmdkGrainMarker); } - ret = bdrv_pwrite(extent->file, - cluster_offset + offset_in_cluster, - write_buf, - write_len); + write_offset = cluster_offset + offset_in_cluster, + ret = bdrv_pwrite(extent->file, write_offset, write_buf, write_len); + + write_end_sector = DIV_ROUND_UP(write_offset + write_len, BDRV_SECTOR_SIZE); + + extent->next_cluster_sector = MAX(extent->next_cluster_sector, + write_end_sector); + if (ret != write_len) { ret = ret < 0 ? ret : -EIO; goto out; |