search

open-iscsi / tcmu-runner

A daemon that handles the userspace side of the LIO TCM-User backstore.
Apache License 2.0
189 stars 149 forks source link

Potential bug in qcow.c rc_cache_lookup #692

Open geordieintheshellcode opened 1 year ago

geordieintheshellcode commented 1 year ago

I stumbled across this while looking at a separate issue. I don't understand the context of this code but it looks like there is a bug in qcow.c rc_cache_lookup on this line https://github.com/open-iscsi/tcmu-runner/blob/main/qcow.c#L731. Compiling with clang one gets:

../qcow.c:731:17: error: variable 'i' used in loop condition not modified in loop body [-Werror,-Wfor-loop-analysis]
                                for (j = 0; i < L2_CACHE_SIZE; j++) {

The code in question:

static void *rc_cache_lookup(struct qcow_state *s, uint64_t rc_offset)
{
        int i, j;
        int min_index = 0;
        int min_count = INT_MAX;
        void *rc_table;
        ssize_t read;

        /* rc cache lookup */
        for (i = 0; i < RC_CACHE_SIZE; i++) {
                if (rc_offset == s->rc_cache_offsets[i]) {
                        if (++s->rc_cache_counts[i] == INT_MAX) {
                                for (j = 0; i < RC_CACHE_SIZE; j++) {  /* ../qcow.c:731:17: error: variable 'i' used in loop condition not modified in loop body [-Werror,-Wfor-loop-analysis] */
                                        s->rc_cache_counts[j] >>= 1;
                                }
                        }
                        rc_table = s->rc_cache + (i << s->cluster_bits);
                        return rc_table;
                }
        }
... snipped...

Maybe somebody could double check and I'll open a PR.