|
 |
9ae3a8 |
From cac9ac8f0173f95893fbc62fa67fcf04e4c76f5f Mon Sep 17 00:00:00 2001
|
|
|
9ae3a8 |
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
9ae3a8 |
Date: Tue, 25 Mar 2014 14:23:15 +0100
|
|
|
9ae3a8 |
Subject: [PATCH 08/49] size off-by-one
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
9ae3a8 |
Message-id: <1395753835-7591-9-git-send-email-kwolf@redhat.com>
|
|
|
9ae3a8 |
Patchwork-id: n/a
|
|
|
9ae3a8 |
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 08/48] block/cloop: fix offsets[] size off-by-one
|
|
|
9ae3a8 |
Bugzilla: 1066691
|
|
|
9ae3a8 |
RH-Acked-by: Jeff Cody <jcody@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1066691
|
|
|
9ae3a8 |
Upstream status: Series embargoed
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
cloop stores the number of compressed blocks in the n_blocks header
|
|
|
9ae3a8 |
field. The file actually contains n_blocks + 1 offsets, where the extra
|
|
|
9ae3a8 |
offset is the end-of-file offset.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
The following line in cloop_read_block() results in an out-of-bounds
|
|
|
9ae3a8 |
offsets[] access:
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
This patch allocates and loads the extra offset so that
|
|
|
9ae3a8 |
cloop_read_block() works correctly when the last block is accessed.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Notice that we must free s->offsets[] unconditionally now since there is
|
|
|
9ae3a8 |
always an end-of-file offset.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
9ae3a8 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
block/cloop.c | 12 +++++-------
|
|
|
9ae3a8 |
tests/qemu-iotests/075 | 5 +++++
|
|
|
9ae3a8 |
tests/qemu-iotests/075.out | 4 ++++
|
|
|
9ae3a8 |
3 files changed, 14 insertions(+), 7 deletions(-)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
diff --git a/block/cloop.c b/block/cloop.c
|
|
|
9ae3a8 |
index 55a804f..b6ad50f 100644
|
|
|
9ae3a8 |
--- a/block/cloop.c
|
|
|
9ae3a8 |
+++ b/block/cloop.c
|
|
|
9ae3a8 |
@@ -99,14 +99,14 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
|
|
|
9ae3a8 |
s->n_blocks = be32_to_cpu(s->n_blocks);
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
/* read offsets */
|
|
|
9ae3a8 |
- if (s->n_blocks > UINT32_MAX / sizeof(uint64_t)) {
|
|
|
9ae3a8 |
+ if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
|
|
|
9ae3a8 |
/* Prevent integer overflow */
|
|
|
9ae3a8 |
error_setg(errp, "n_blocks %u must be %zu or less",
|
|
|
9ae3a8 |
s->n_blocks,
|
|
|
9ae3a8 |
- UINT32_MAX / sizeof(uint64_t));
|
|
|
9ae3a8 |
+ (UINT32_MAX - 1) / sizeof(uint64_t));
|
|
|
9ae3a8 |
return -EINVAL;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
- offsets_size = s->n_blocks * sizeof(uint64_t);
|
|
|
9ae3a8 |
+ offsets_size = (s->n_blocks + 1) * sizeof(uint64_t);
|
|
|
9ae3a8 |
if (offsets_size > 512 * 1024 * 1024) {
|
|
|
9ae3a8 |
/* Prevent ridiculous offsets_size which causes memory allocation to
|
|
|
9ae3a8 |
* fail or overflows bdrv_pread() size. In practice the 512 MB
|
|
|
9ae3a8 |
@@ -123,7 +123,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
|
|
|
9ae3a8 |
goto fail;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
- for(i=0;i<s->n_blocks;i++) {
|
|
|
9ae3a8 |
+ for (i = 0; i < s->n_blocks + 1; i++) {
|
|
|
9ae3a8 |
uint64_t size;
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
s->offsets[i] = be64_to_cpu(s->offsets[i]);
|
|
|
9ae3a8 |
@@ -243,9 +243,7 @@ static coroutine_fn int cloop_co_read(BlockDriverState *bs, int64_t sector_num,
|
|
|
9ae3a8 |
static void cloop_close(BlockDriverState *bs)
|
|
|
9ae3a8 |
{
|
|
|
9ae3a8 |
BDRVCloopState *s = bs->opaque;
|
|
|
9ae3a8 |
- if (s->n_blocks > 0) {
|
|
|
9ae3a8 |
- g_free(s->offsets);
|
|
|
9ae3a8 |
- }
|
|
|
9ae3a8 |
+ g_free(s->offsets);
|
|
|
9ae3a8 |
g_free(s->compressed_block);
|
|
|
9ae3a8 |
g_free(s->uncompressed_block);
|
|
|
9ae3a8 |
inflateEnd(&s->zstream);
|
|
|
9ae3a8 |
diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075
|
|
|
9ae3a8 |
index d74fb33..40032c5 100755
|
|
|
9ae3a8 |
--- a/tests/qemu-iotests/075
|
|
|
9ae3a8 |
+++ b/tests/qemu-iotests/075
|
|
|
9ae3a8 |
@@ -52,6 +52,11 @@ _use_sample_img simple-pattern.cloop.bz2
|
|
|
9ae3a8 |
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
echo
|
|
|
9ae3a8 |
+echo "== check that the last sector can be read =="
|
|
|
9ae3a8 |
+_use_sample_img simple-pattern.cloop.bz2
|
|
|
9ae3a8 |
+$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
9ae3a8 |
+
|
|
|
9ae3a8 |
+echo
|
|
|
9ae3a8 |
echo "== block_size must be a multiple of 512 =="
|
|
|
9ae3a8 |
_use_sample_img simple-pattern.cloop.bz2
|
|
|
9ae3a8 |
poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01"
|
|
|
9ae3a8 |
diff --git a/tests/qemu-iotests/075.out b/tests/qemu-iotests/075.out
|
|
|
9ae3a8 |
index 911cd3b..5f1d6c1 100644
|
|
|
9ae3a8 |
--- a/tests/qemu-iotests/075.out
|
|
|
9ae3a8 |
+++ b/tests/qemu-iotests/075.out
|
|
|
9ae3a8 |
@@ -4,6 +4,10 @@ QA output created by 075
|
|
|
9ae3a8 |
read 512/512 bytes at offset 0
|
|
|
9ae3a8 |
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
+== check that the last sector can be read ==
|
|
|
9ae3a8 |
+read 512/512 bytes at offset 1048064
|
|
|
9ae3a8 |
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
9ae3a8 |
+
|
|
|
9ae3a8 |
== block_size must be a multiple of 512 ==
|
|
|
9ae3a8 |
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512
|
|
|
9ae3a8 |
no file open, try 'help open'
|
|
|
9ae3a8 |
--
|
|
|
9ae3a8 |
1.7.1
|
|
|
9ae3a8 |
|