• D
    nbd: fix max_discard/max_transfer_length · fa21e6fa
    Denis V. Lunev 提交于
    nbd_co_discard calls nbd_client_session_co_discard which uses uint32_t
    as the length in bytes of the data to discard due to the following
    definition:
    
    struct nbd_request {
        uint32_t magic;
        uint32_t type;
        uint64_t handle;
        uint64_t from;
        uint32_t len; <-- the length of data to be discarded, in bytes
    } QEMU_PACKED;
    
    Thus we should limit bl_max_discard to UINT32_MAX >> BDRV_SECTOR_BITS to
    avoid overflow.
    
    NBD read/write code uses the same structure for transfers. Fix
    max_transfer_length accordingly.
    Signed-off-by: NDenis V. Lunev <den@openvz.org>
    CC: Peter Lieven <pl@kamp.de>
    CC: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: NKevin Wolf <kwolf@redhat.com>
    fa21e6fa
nbd.c 13.7 KB