From 0778a1015e71f3ea6d79487fad159aa8f299a9c8 Mon Sep 17 00:00:00 2001 From: Daniel P. Berrange Date: Feb 28 2008 00:27:23 +0000 Subject: Fix block device checks for extendable disk formats (rhbz #435139) --- diff --git a/qemu-0.9.1-block-rw-range-check.patch b/qemu-0.9.1-block-rw-range-check.patch index a32af8c..9d098b6 100644 --- a/qemu-0.9.1-block-rw-range-check.patch +++ b/qemu-0.9.1-block-rw-range-check.patch @@ -1,33 +1,79 @@ -diff --git a/block.c b/block.c -index 0f8ad7b..d7f1114 100644 ---- a/block.c -+++ b/block.c -@@ -123,6 +123,24 @@ void path_combine(char *dest, int dest_size, +diff -rup qemu-0.9.1.orig/block.c qemu-0.9.1.new/block.c +--- qemu-0.9.1.orig/block.c 2008-02-26 18:03:00.000000000 -0500 ++++ qemu-0.9.1.new/block.c 2008-02-26 18:05:26.000000000 -0500 +@@ -123,6 +123,60 @@ void path_combine(char *dest, int dest_s } } -+static int bdrv_rw_badreq_sectors(BlockDriverState *bs, -+ int64_t sector_num, int nb_sectors) ++static int bdrv_rd_badreq_sectors(BlockDriverState *bs, ++ int64_t sector_num, int nb_sectors) +{ + return -+ nb_sectors < 0 || -+ nb_sectors > bs->total_sectors || -+ sector_num > bs->total_sectors - nb_sectors; ++ nb_sectors < 0 || ++ sector_num < 0 || ++ nb_sectors > bs->total_sectors || ++ sector_num > bs->total_sectors - nb_sectors; +} + -+static int bdrv_rw_badreq_bytes(BlockDriverState *bs, -+ int64_t offset, int count) ++static int bdrv_rd_badreq_bytes(BlockDriverState *bs, ++ int64_t offset, int count) +{ + int64_t size = bs->total_sectors << SECTOR_BITS; + return -+ count < 0 || -+ count > size || -+ offset > size - count; ++ count < 0 || ++ size < 0 || ++ count > size || ++ offset > size - count; +} ++ ++static int bdrv_wr_badreq_sectors(BlockDriverState *bs, ++ int64_t sector_num, int nb_sectors) ++{ ++ if (sector_num < 0 || ++ nb_sectors < 0) ++ return 1; ++ ++ if (sector_num > bs->total_sectors - nb_sectors) { ++ if (bs->autogrow) ++ bs->total_sectors = sector_num + nb_sectors; ++ else ++ return 1; ++ } ++ return 0; ++} ++ ++static int bdrv_wr_badreq_bytes(BlockDriverState *bs, ++ int64_t offset, int count) ++{ ++ int64_t size = bs->total_sectors << SECTOR_BITS; ++ if (count < 0 || ++ offset < 0) ++ return 1; ++ ++ if (offset > size - count) { ++ if (bs->autogrow) ++ bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS; ++ else ++ return 1; ++ } ++ return 0; ++} ++ static void bdrv_register(BlockDriver *bdrv) { -@@ -375,6 +393,7 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags, +@@ -331,6 +385,10 @@ int bdrv_open2(BlockDriverState *bs, con + bs->read_only = 0; + bs->is_temporary = 0; + bs->encrypted = 0; ++ bs->autogrow = 0; ++ ++ if (flags & BDRV_O_AUTOGROW) ++ bs->autogrow = 1; + + if (flags & BDRV_O_SNAPSHOT) { + BlockDriverState *bs1; +@@ -375,6 +433,7 @@ int bdrv_open2(BlockDriverState *bs, con } bs->drv = drv; bs->opaque = qemu_mallocz(drv->instance_size); @@ -35,74 +81,132 @@ index 0f8ad7b..d7f1114 100644 if (bs->opaque == NULL && drv->instance_size > 0) return -1; /* Note: for compatibility, we open disk image files as RDWR, and -@@ -440,6 +459,7 @@ void bdrv_close(BlockDriverState *bs) +@@ -440,6 +499,7 @@ void bdrv_close(BlockDriverState *bs) bs->drv = NULL; /* call the change callback */ -+ bs->total_sectors = 0; ++ bs->total_sectors = 0; bs->media_changed = 1; if (bs->change_cb) bs->change_cb(bs->change_opaque); -@@ -505,6 +525,8 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num, +@@ -505,6 +565,8 @@ int bdrv_read(BlockDriverState *bs, int6 if (!drv) return -ENOMEDIUM; -+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) -+ return -EDOM; ++ if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors)) ++ return -EDOM; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(buf, bs->boot_sector_data, 512); sector_num++; -@@ -545,6 +567,8 @@ int bdrv_write(BlockDriverState *bs, int64_t sector_num, +@@ -545,6 +607,8 @@ int bdrv_write(BlockDriverState *bs, int return -ENOMEDIUM; if (bs->read_only) return -EACCES; -+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) -+ return -EDOM; ++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors)) ++ return -EDOM; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(bs->boot_sector_data, buf, 512); } -@@ -670,6 +694,8 @@ int bdrv_pread(BlockDriverState *bs, int64_t offset, +@@ -670,6 +734,8 @@ int bdrv_pread(BlockDriverState *bs, int return -ENOMEDIUM; if (!drv->bdrv_pread) return bdrv_pread_em(bs, offset, buf1, count1); -+ if (bdrv_rw_badreq_bytes(bs, offset, count1)) -+ return -EDOM; ++ if (bdrv_rd_badreq_bytes(bs, offset, count1)) ++ return -EDOM; return drv->bdrv_pread(bs, offset, buf1, count1); } -@@ -685,6 +711,8 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset, +@@ -685,6 +751,8 @@ int bdrv_pwrite(BlockDriverState *bs, in return -ENOMEDIUM; if (!drv->bdrv_pwrite) return bdrv_pwrite_em(bs, offset, buf1, count1); -+ if (bdrv_rw_badreq_bytes(bs, offset, count1)) -+ return -EDOM; ++ if (bdrv_wr_badreq_bytes(bs, offset, count1)) ++ return -EDOM; return drv->bdrv_pwrite(bs, offset, buf1, count1); } -@@ -951,6 +979,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num, +@@ -951,6 +1019,8 @@ int bdrv_write_compressed(BlockDriverSta return -ENOMEDIUM; if (!drv->bdrv_write_compressed) return -ENOTSUP; -+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) -+ return -EDOM; ++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors)) ++ return -EDOM; return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors); } -@@ -1097,6 +1127,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num, +@@ -1097,6 +1167,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri if (!drv) return NULL; -+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) -+ return NULL; ++ if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors)) ++ return NULL; /* XXX: we assume that nb_sectors == 0 is suppored by the async read */ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { -@@ -1128,6 +1160,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num, +@@ -1128,6 +1200,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr return NULL; if (bs->read_only) return NULL; -+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) -+ return NULL; ++ if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors)) ++ return NULL; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(bs->boot_sector_data, buf, 512); } +diff -rup qemu-0.9.1.orig/block.h qemu-0.9.1.new/block.h +--- qemu-0.9.1.orig/block.h 2008-01-06 14:38:42.000000000 -0500 ++++ qemu-0.9.1.new/block.h 2008-02-26 17:41:47.000000000 -0500 +@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo { + it (default for + bdrv_file_open()) */ + #define BDRV_O_DIRECT 0x0020 ++#define BDRV_O_AUTOGROW 0x0040 /* Allow backing file to extend when writing past end of file */ + + #ifndef QEMU_IMG + void bdrv_info(void); +diff -rup qemu-0.9.1.orig/block_int.h qemu-0.9.1.new/block_int.h +--- qemu-0.9.1.orig/block_int.h 2008-01-06 14:38:42.000000000 -0500 ++++ qemu-0.9.1.new/block_int.h 2008-02-26 17:41:47.000000000 -0500 +@@ -97,6 +97,7 @@ struct BlockDriverState { + int locked; /* if true, the media cannot temporarily be ejected */ + int encrypted; /* if true, the media is encrypted */ + int sg; /* if true, the device is a /dev/sg* */ ++ int autogrow; /* if true, the backing store can auto-extend to allocate new extents */ + /* event callback when inserting/removing */ + void (*change_cb)(void *opaque); + void *change_opaque; +diff -rup qemu-0.9.1.orig/block-qcow2.c qemu-0.9.1.new/block-qcow2.c +--- qemu-0.9.1.orig/block-qcow2.c 2008-01-06 14:38:42.000000000 -0500 ++++ qemu-0.9.1.new/block-qcow2.c 2008-02-26 18:01:06.000000000 -0500 +@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b + int len, i, shift, ret; + QCowHeader header; + +- ret = bdrv_file_open(&s->hd, filename, flags); ++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW); + if (ret < 0) + return ret; + if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header)) +diff -rup qemu-0.9.1.orig/block-qcow.c qemu-0.9.1.new/block-qcow.c +--- qemu-0.9.1.orig/block-qcow.c 2008-01-06 14:38:41.000000000 -0500 ++++ qemu-0.9.1.new/block-qcow.c 2008-02-26 18:00:53.000000000 -0500 +@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b + int len, i, shift, ret; + QCowHeader header; + +- ret = bdrv_file_open(&s->hd, filename, flags); ++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW); + if (ret < 0) + return ret; + if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header)) +diff -rup qemu-0.9.1.orig/block-vmdk.c qemu-0.9.1.new/block-vmdk.c +--- qemu-0.9.1.orig/block-vmdk.c 2008-01-06 14:38:42.000000000 -0500 ++++ qemu-0.9.1.new/block-vmdk.c 2008-02-26 18:02:17.000000000 -0500 +@@ -376,7 +376,7 @@ static int vmdk_open(BlockDriverState *b + flags = BDRV_O_RDONLY; + fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename); + +- ret = bdrv_file_open(&s->hd, filename, flags); ++ ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW); + if (ret < 0) + return ret; + if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic)) diff --git a/qemu.spec b/qemu.spec index e97806b..b63ea7f 100644 --- a/qemu.spec +++ b/qemu.spec @@ -8,7 +8,7 @@ Summary: QEMU is a FAST! processor emulator Name: qemu Version: 0.9.1 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ Group: Development/Tools URL: http://www.qemu.org/ @@ -94,7 +94,10 @@ fi %{_mandir}/man1/* %changelog -* Sat Feb 23 2008 Daniel Berrange - 0.9.1-3.fc9 +* Wed Feb 27 2008 Daniel P. Berrange - 0.9.1-4.fc9 +- Fix block device checks for extendable disk formats (rhbz #435139) + +* Sat Feb 23 2008 Daniel P. Berrange - 0.9.1-3.fc9 - Fix block device extents check (rhbz #433560) * Mon Feb 18 2008 Fedora Release Engineering - 0.9.1-2