yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
619821
From 32dcdb3b1623e351d66bfe7cccbdcef3087f9b7b Mon Sep 17 00:00:00 2001
619821
From: Max Reitz <mreitz@redhat.com>
619821
Date: Mon, 13 Mar 2017 17:45:09 +0100
619821
Subject: [PATCH 11/24] qcow2: Don't rely on free_cluster_index in
619821
 alloc_refcount_block() (CVE-2014-0147)
619821
619821
RH-Author: Max Reitz <mreitz@redhat.com>
619821
Message-id: <20170313174516.28044-3-mreitz@redhat.com>
619821
Patchwork-id: 74274
619821
O-Subject: [RHEL-7.4 qemu-kvm PATCH 2/9] qcow2: Don't rely on free_cluster_index in alloc_refcount_block() (CVE-2014-0147)
619821
Bugzilla: 1427176
619821
RH-Acked-by: Fam Zheng <famz@redhat.com>
619821
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
619821
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
619821
619821
From: Kevin Wolf <kwolf@redhat.com>
619821
619821
free_cluster_index is only correct if update_refcount() was called from
619821
an allocation function, and even there it's brittle because it's used to
619821
protect unfinished allocations which still have a refcount of 0 - if it
619821
moves in the wrong place, the unfinished allocation can be corrupted.
619821
619821
So not using it any more seems to be a good idea. Instead, use the
619821
first requested cluster to do the calculations. Return -EAGAIN if
619821
unfinished allocations could become invalid and let the caller restart
619821
its search for some free clusters.
619821
619821
The context of creating a snapsnot is one situation where
619821
update_refcount() is called outside of a cluster allocation. For this
619821
case, the change fixes a buffer overflow if a cluster is referenced in
619821
an L2 table that cannot be represented by an existing refcount block.
619821
(new_table[refcount_table_index] was out of bounds)
619821
619821
[Bump the qemu-iotests 026 refblock_alloc.write leak count from 10 to
619821
11.
619821
--Stefan]
619821
619821
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
619821
Reviewed-by: Max Reitz <mreitz@redhat.com>
619821
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
619821
(cherry picked from commit b106ad9185f35fc4ad669555ad0e79e276083bd7)
619821
619821
This patch was committed downstream before upstream (commit ID
619821
a2b10eec76a72aa7fe63e797181b93f69de9600e), therefore the change to 026's
619821
reference output is missing, which is amended by this backport.
619821
619821
Signed-off-by: Max Reitz <mreitz@redhat.com>
619821
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
619821
---
619821
 tests/qemu-iotests/026.out | 6 +++---
619821
 1 file changed, 3 insertions(+), 3 deletions(-)
619821
619821
diff --git a/tests/qemu-iotests/026.out b/tests/qemu-iotests/026.out
619821
index 0764389..5cedefc 100644
619821
--- a/tests/qemu-iotests/026.out
619821
+++ b/tests/qemu-iotests/026.out
619821
@@ -491,7 +491,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
619821
 Event: refblock_alloc.write_blocks; errno: 28; imm: off; once: off; write 
619821
 write failed: No space left on device
619821
 
619821
-10 leaked clusters were found on the image.
619821
+11 leaked clusters were found on the image.
619821
 This means waste of disk space, but no harm to data.
619821
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
619821
 
619821
@@ -515,7 +515,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
619821
 Event: refblock_alloc.write_table; errno: 28; imm: off; once: off; write 
619821
 write failed: No space left on device
619821
 
619821
-10 leaked clusters were found on the image.
619821
+11 leaked clusters were found on the image.
619821
 This means waste of disk space, but no harm to data.
619821
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
619821
 
619821
@@ -539,7 +539,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
619821
 Event: refblock_alloc.switch_table; errno: 28; imm: off; once: off; write 
619821
 write failed: No space left on device
619821
 
619821
-10 leaked clusters were found on the image.
619821
+11 leaked clusters were found on the image.
619821
 This means waste of disk space, but no harm to data.
619821
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
619821
 
619821
-- 
619821
1.8.3.1
619821