diff --git a/0001-qcow2-Handle-EAGAIN-returned-from-update_refcount.patch b/0001-qcow2-Handle-EAGAIN-returned-from-update_refcount.patch new file mode 100644 index 0000000..ebdfffb --- /dev/null +++ b/0001-qcow2-Handle-EAGAIN-returned-from-update_refcount.patch @@ -0,0 +1,57 @@ +From 3e5feb6202149e8a963a33b911216e40d790f1d7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jind=C5=99ich=20Makovi=C4=8Dka?= +Date: Wed, 24 Jun 2015 07:05:25 +0200 +Subject: [PATCH] qcow2: Handle EAGAIN returned from update_refcount +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fixes a crash during image compression + +Signed-off-by: Jindřich Makovička +Tested-by: Richard W.M. Jones +Reviewed-by: Max Reitz +Signed-off-by: Stefan Hajnoczi +--- + block/qcow2-refcount.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c +index 0632fc3..b0ee42d 100644 +--- a/block/qcow2-refcount.c ++++ b/block/qcow2-refcount.c +@@ -940,19 +940,21 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size) + } + + free_in_cluster = s->cluster_size - offset_into_cluster(s, offset); +- if (!offset || free_in_cluster < size) { +- int64_t new_cluster = alloc_clusters_noref(bs, s->cluster_size); +- if (new_cluster < 0) { +- return new_cluster; +- } ++ do { ++ if (!offset || free_in_cluster < size) { ++ int64_t new_cluster = alloc_clusters_noref(bs, s->cluster_size); ++ if (new_cluster < 0) { ++ return new_cluster; ++ } + +- if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) { +- offset = new_cluster; ++ if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) { ++ offset = new_cluster; ++ } + } +- } + +- assert(offset); +- ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER); ++ assert(offset); ++ ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER); ++ } while (ret == -EAGAIN); + if (ret < 0) { + return ret; + } +-- +2.4.3 + diff --git a/qemu.spec b/qemu.spec index ac80df1..96cef3f 100644 --- a/qemu.spec +++ b/qemu.spec @@ -43,7 +43,7 @@ Summary: QEMU is a FAST! processor emulator Name: qemu Version: 2.3.0 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 2 License: GPLv2+ and LGPLv2+ and BSD Group: Development/Tools @@ -78,6 +78,11 @@ Patch0001: 0001-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch # #1222894) Patch0002: 0002-slirp-use-less-predictable-directory-name-in-tmp-for.patch +# Fix: qemu-img: error while compressing sector : Input/output error +# https://bugzilla.redhat.com/show_bug.cgi?id=1214855 +# Upstream in 2.4.0-rc0 +Patch0003: 0001-qcow2-Handle-EAGAIN-returned-from-update_refcount.patch + BuildRequires: SDL2-devel BuildRequires: zlib-devel BuildRequires: which @@ -1179,6 +1184,9 @@ getent passwd qemu >/dev/null || \ %changelog +* Mon Jul 20 2015 Richard W.M. Jones - 2:2.3.0-6 +- Fix: qemu-img: error while compressing sector : Input/output error (bz #1214855) + * Fri Jun 05 2015 Cole Robinson - 2:2.3.0-5 - CVE-2015-4037: insecure temporary file use in /net/slirp.c (bz #1222894)