cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
05bba0
From cd10207e755b1b0470503c72c78a8d927f87a37a Mon Sep 17 00:00:00 2001
05bba0
From: Max Reitz <mreitz@redhat.com>
05bba0
Date: Sat, 13 Jun 2015 16:21:58 +0200
05bba0
Subject: [PATCH 04/42] qcow2: Catch !*host_offset for data allocation
05bba0
05bba0
Message-id: <1434212556-3927-5-git-send-email-mreitz@redhat.com>
05bba0
Patchwork-id: 66023
05bba0
O-Subject: [RHEL-7.2 qemu-kvm PATCH 04/42] qcow2: Catch !*host_offset for data allocation
05bba0
Bugzilla: 1129893
05bba0
RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
05bba0
RH-Acked-by: Fam Zheng <famz@redhat.com>
05bba0
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
05bba0
05bba0
BZ: 1129893
05bba0
05bba0
qcow2_alloc_cluster_offset() uses host_offset == 0 as "no preferred
05bba0
offset" for the (data) cluster range to be allocated. However, this
05bba0
offset is actually valid and may be allocated on images with a corrupted
05bba0
refcount table or first refcount block.
05bba0
05bba0
In this case, the corruption prevention should normally catch that
05bba0
write anyway (because it would overwrite the image header). But since 0
05bba0
is a special value here, the function assumes that nothing has been
05bba0
allocated at all which it asserts against.
05bba0
05bba0
Because this condition is not qemu's fault but rather that of a broken
05bba0
image, it shouldn't throw an assertion but rather mark the image corrupt
05bba0
and show an appropriate message, which this patch does by calling the
05bba0
corruption check earlier than it would be called normally (before the
05bba0
assertion).
05bba0
05bba0
Signed-off-by: Max Reitz <mreitz@redhat.com>
05bba0
Reviewed-by: Eric Blake <eblake@redhat.com>
05bba0
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
05bba0
(cherry picked from commit ff52aab2df5c5e10f231481961b88d25a3021724)
05bba0
05bba0
Signed-off-by: Max Reitz <mreitz@redhat.com>
05bba0
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
05bba0
---
05bba0
 block/qcow2-cluster.c | 11 +++++++++++
05bba0
 1 file changed, 11 insertions(+)
05bba0
05bba0
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
05bba0
index 1b9609f..f2f1170 100644
05bba0
--- a/block/qcow2-cluster.c
05bba0
+++ b/block/qcow2-cluster.c
05bba0
@@ -1089,6 +1089,17 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
05bba0
         return 0;
05bba0
     }
05bba0
 
05bba0
+    /* !*host_offset would overwrite the image header and is reserved for "no
05bba0
+     * host offset preferred". If 0 was a valid host offset, it'd trigger the
05bba0
+     * following overlap check; do that now to avoid having an invalid value in
05bba0
+     * *host_offset. */
05bba0
+    if (!alloc_cluster_offset) {
05bba0
+        ret = qcow2_pre_write_overlap_check(bs, 0, alloc_cluster_offset,
05bba0
+                                            nb_clusters * s->cluster_size);
05bba0
+        assert(ret < 0);
05bba0
+        goto fail;
05bba0
+    }
05bba0
+
05bba0
     /*
05bba0
      * Save info needed for meta data update.
05bba0
      *
05bba0
-- 
05bba0
1.8.3.1
05bba0