|
 |
05bba0 |
From cd10207e755b1b0470503c72c78a8d927f87a37a Mon Sep 17 00:00:00 2001
|
|
|
05bba0 |
From: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Date: Sat, 13 Jun 2015 16:21:58 +0200
|
|
|
05bba0 |
Subject: [PATCH 04/42] qcow2: Catch !*host_offset for data allocation
|
|
|
05bba0 |
|
|
|
05bba0 |
Message-id: <1434212556-3927-5-git-send-email-mreitz@redhat.com>
|
|
|
05bba0 |
Patchwork-id: 66023
|
|
|
05bba0 |
O-Subject: [RHEL-7.2 qemu-kvm PATCH 04/42] qcow2: Catch !*host_offset for data allocation
|
|
|
05bba0 |
Bugzilla: 1129893
|
|
|
05bba0 |
RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Fam Zheng <famz@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
05bba0 |
|
|
|
05bba0 |
BZ: 1129893
|
|
|
05bba0 |
|
|
|
05bba0 |
qcow2_alloc_cluster_offset() uses host_offset == 0 as "no preferred
|
|
|
05bba0 |
offset" for the (data) cluster range to be allocated. However, this
|
|
|
05bba0 |
offset is actually valid and may be allocated on images with a corrupted
|
|
|
05bba0 |
refcount table or first refcount block.
|
|
|
05bba0 |
|
|
|
05bba0 |
In this case, the corruption prevention should normally catch that
|
|
|
05bba0 |
write anyway (because it would overwrite the image header). But since 0
|
|
|
05bba0 |
is a special value here, the function assumes that nothing has been
|
|
|
05bba0 |
allocated at all which it asserts against.
|
|
|
05bba0 |
|
|
|
05bba0 |
Because this condition is not qemu's fault but rather that of a broken
|
|
|
05bba0 |
image, it shouldn't throw an assertion but rather mark the image corrupt
|
|
|
05bba0 |
and show an appropriate message, which this patch does by calling the
|
|
|
05bba0 |
corruption check earlier than it would be called normally (before the
|
|
|
05bba0 |
assertion).
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Reviewed-by: Eric Blake <eblake@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
05bba0 |
(cherry picked from commit ff52aab2df5c5e10f231481961b88d25a3021724)
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
05bba0 |
---
|
|
|
05bba0 |
block/qcow2-cluster.c | 11 +++++++++++
|
|
|
05bba0 |
1 file changed, 11 insertions(+)
|
|
|
05bba0 |
|
|
|
05bba0 |
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
|
|
|
05bba0 |
index 1b9609f..f2f1170 100644
|
|
|
05bba0 |
--- a/block/qcow2-cluster.c
|
|
|
05bba0 |
+++ b/block/qcow2-cluster.c
|
|
|
05bba0 |
@@ -1089,6 +1089,17 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
|
|
|
05bba0 |
return 0;
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
+ /* !*host_offset would overwrite the image header and is reserved for "no
|
|
|
05bba0 |
+ * host offset preferred". If 0 was a valid host offset, it'd trigger the
|
|
|
05bba0 |
+ * following overlap check; do that now to avoid having an invalid value in
|
|
|
05bba0 |
+ * *host_offset. */
|
|
|
05bba0 |
+ if (!alloc_cluster_offset) {
|
|
|
05bba0 |
+ ret = qcow2_pre_write_overlap_check(bs, 0, alloc_cluster_offset,
|
|
|
05bba0 |
+ nb_clusters * s->cluster_size);
|
|
|
05bba0 |
+ assert(ret < 0);
|
|
|
05bba0 |
+ goto fail;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+
|
|
|
05bba0 |
/*
|
|
|
05bba0 |
* Save info needed for meta data update.
|
|
|
05bba0 |
*
|
|
|
05bba0 |
--
|
|
|
05bba0 |
1.8.3.1
|
|
|
05bba0 |
|