From 28b1fc72bb2d8398b27e47cf13c60fc432c9811a Mon Sep 17 00:00:00 2001
From: Max Reitz <mreitz@redhat.com>
Date: Fri, 2 May 2014 16:58:45 -0500
Subject: [PATCH 13/26] qcow2: Correct snapshots size for overlap check

RH-Author: Max Reitz <mreitz@redhat.com>
Message-id: <1399049936-13496-14-git-send-email-mreitz@redhat.com>
Patchwork-id: 58659
O-Subject: [RHEL-6.6 qemu-kvm PATCH v3 13/24] qcow2: Correct snapshots size for overlap check
Bugzilla: 1004420
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

BZ: 1004420

Using s->snapshots_size instead of snapshots_size for the metadata
overlap check in qcow2_write_snapshots leads to the detection of an
overlap with the main qcow2 image header when deleting the last
snapshot, since s->snapshots_size has not yet been updated and is
therefore non-zero. However, the offset returned by qcow2_alloc_clusters
will be zero since snapshots_size is zero. Therefore, an overlap is
detected albeit no such will occur.

This patch fixes this by replacing s->snapshots_size by snapshots_size
when calling qcow2_pre_write_overlap_check.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 0f39ac9a07cc10278e37d87076b143008f28aa3b)

Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/qcow2-snapshot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Signed-off-by: Jeff E. Nelson <jen@redhat.com>
---
 block/qcow2-snapshot.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 917a2e1..821a534 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -159,7 +159,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
     /* The snapshot list position has not yet been updated, so these clusters
      * must indeed be completely free */
     ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_DEFAULT, offset,
-                                        s->snapshots_size);
+                                        snapshots_size);
     if (ret < 0) {
         return ret;
     }
-- 
1.7.1

