unmap: fix the potential negative length

    We should not handle the unmap length less than the sector size to
    prevent the negative length.

    e.g. if the sector size is 4096 bytes, we try to unmap the 512 byte
    start from offset 1.
    The `startSectorOffset` would be 1. The `endSectorOffset` would be 513.
    Then the `length` would be a negative number.

    The minimal unmap unit is the sector size, so we could
    return if the length is less than the sector size. That also can
    avoid the above situation.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>
Co-authored-by: Derek Su <derek.su@suse.com>

pkg/replica/diff_disk.go

@@ -290,10 +290,11 @@ func (d *diffDisk) lookup(sector int64) (byte, error) {
 }
 
 func (d *diffDisk) UnmapAt(unmappableDisks []string, length uint32, offset int64) (int, error) {
-	if length == 0 {
+	if length < uint32(d.sectorSize) {
 		return 0, nil
 	}
 
+	origLength := length
 	startSectorOffset := offset % d.sectorSize
 	endSectorOffset := (int64(length) + offset) % d.sectorSize
 
@@ -304,10 +305,17 @@ func (d *diffDisk) UnmapAt(unmappableDisks []string, length uint32, offset int64
 	if endSectorOffset != 0 {
 		length -= uint32(endSectorOffset)
 	}
-	if length <= 0 {
+	if length == 0 {
 		return 0, nil
 	}
 
+	// The the final length must be smaller than original length. The following case should not happen.
+	// The only case is the length is calculated to a negative number and then overflows a large number.
+	// This protection mechanism avoids unmapping the abnormal length and returns errors.
+	if origLength < length {
+		return 0, fmt.Errorf("final unmap length(%v) should not be larger than original length(%v)", length, origLength)
+	}
+
 	var unmappedSizeErr error
 	unmappedSize := int64(0)
 	actualSizeBefore, actualSizeAfter := int64(0), int64(0)