|
 |
05bba0 |
From 707d22d6fe9d2f43d0372472b62d40ddb652385d Mon Sep 17 00:00:00 2001
|
|
|
05bba0 |
From: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Date: Sat, 13 Jun 2015 16:22:20 +0200
|
|
|
05bba0 |
Subject: [PATCH 26/42] qcow2: Fix refcount blocks beyond image end
|
|
|
05bba0 |
|
|
|
05bba0 |
Message-id: <1434212556-3927-27-git-send-email-mreitz@redhat.com>
|
|
|
05bba0 |
Patchwork-id: 66045
|
|
|
05bba0 |
O-Subject: [RHEL-7.2 qemu-kvm PATCH 26/42] qcow2: Fix refcount blocks beyond image end
|
|
|
05bba0 |
Bugzilla: 1129893
|
|
|
05bba0 |
RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Fam Zheng <famz@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
05bba0 |
|
|
|
05bba0 |
BZ: 1129893
|
|
|
05bba0 |
|
|
|
05bba0 |
If the qcow2 check function detects a refcount block located beyond the
|
|
|
05bba0 |
image end, grow the image appropriately. This cannot break anything and
|
|
|
05bba0 |
is the logical fix for such a case.
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
05bba0 |
(cherry picked from commit 001c158defb65e88e6c50c85d6f20501f7149ddd)
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
05bba0 |
---
|
|
|
05bba0 |
block/qcow2-refcount.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++---
|
|
|
05bba0 |
1 file changed, 63 insertions(+), 4 deletions(-)
|
|
|
05bba0 |
|
|
|
05bba0 |
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
|
|
|
05bba0 |
index 8f1215c..8ce0447 100644
|
|
|
05bba0 |
--- a/block/qcow2-refcount.c
|
|
|
05bba0 |
+++ b/block/qcow2-refcount.c
|
|
|
05bba0 |
@@ -1545,7 +1545,7 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
|
|
|
05bba0 |
int64_t *nb_clusters)
|
|
|
05bba0 |
{
|
|
|
05bba0 |
BDRVQcowState *s = bs->opaque;
|
|
|
05bba0 |
- int64_t i;
|
|
|
05bba0 |
+ int64_t i, size;
|
|
|
05bba0 |
int ret;
|
|
|
05bba0 |
|
|
|
05bba0 |
for(i = 0; i < s->refcount_table_size; i++) {
|
|
|
05bba0 |
@@ -1562,9 +1562,68 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
if (cluster >= *nb_clusters) {
|
|
|
05bba0 |
- fprintf(stderr, "ERROR refcount block %" PRId64
|
|
|
05bba0 |
- " is outside image\n", i);
|
|
|
05bba0 |
- res->corruptions++;
|
|
|
05bba0 |
+ fprintf(stderr, "%s refcount block %" PRId64 " is outside image\n",
|
|
|
05bba0 |
+ fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", i);
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ if (fix & BDRV_FIX_ERRORS) {
|
|
|
05bba0 |
+ int64_t old_nb_clusters = *nb_clusters;
|
|
|
05bba0 |
+ uint16_t *new_refcount_table;
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ if (offset > INT64_MAX - s->cluster_size) {
|
|
|
05bba0 |
+ ret = -EINVAL;
|
|
|
05bba0 |
+ goto resize_fail;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ ret = bdrv_truncate(bs->file, offset + s->cluster_size);
|
|
|
05bba0 |
+ if (ret < 0) {
|
|
|
05bba0 |
+ goto resize_fail;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+ size = bdrv_getlength(bs->file);
|
|
|
05bba0 |
+ if (size < 0) {
|
|
|
05bba0 |
+ ret = size;
|
|
|
05bba0 |
+ goto resize_fail;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ *nb_clusters = size_to_clusters(s, size);
|
|
|
05bba0 |
+ assert(*nb_clusters >= old_nb_clusters);
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ new_refcount_table = g_try_realloc(*refcount_table,
|
|
|
05bba0 |
+ *nb_clusters *
|
|
|
05bba0 |
+ sizeof(**refcount_table));
|
|
|
05bba0 |
+ if (!new_refcount_table) {
|
|
|
05bba0 |
+ *nb_clusters = old_nb_clusters;
|
|
|
05bba0 |
+ res->check_errors++;
|
|
|
05bba0 |
+ return -ENOMEM;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+ *refcount_table = new_refcount_table;
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ memset(*refcount_table + old_nb_clusters, 0,
|
|
|
05bba0 |
+ (*nb_clusters - old_nb_clusters) *
|
|
|
05bba0 |
+ sizeof(**refcount_table));
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ if (cluster >= *nb_clusters) {
|
|
|
05bba0 |
+ ret = -EINVAL;
|
|
|
05bba0 |
+ goto resize_fail;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+ res->corruptions_fixed++;
|
|
|
05bba0 |
+ ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
|
|
|
05bba0 |
+ offset, s->cluster_size);
|
|
|
05bba0 |
+ if (ret < 0) {
|
|
|
05bba0 |
+ return ret;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
+ /* No need to check whether the refcount is now greater than 1:
|
|
|
05bba0 |
+ * This area was just allocated and zeroed, so it can only be
|
|
|
05bba0 |
+ * exactly 1 after inc_refcounts() */
|
|
|
05bba0 |
+ continue;
|
|
|
05bba0 |
+
|
|
|
05bba0 |
+resize_fail:
|
|
|
05bba0 |
+ res->corruptions++;
|
|
|
05bba0 |
+ fprintf(stderr, "ERROR could not resize image: %s\n",
|
|
|
05bba0 |
+ strerror(-ret));
|
|
|
05bba0 |
+ } else {
|
|
|
05bba0 |
+ res->corruptions++;
|
|
|
05bba0 |
+ }
|
|
|
05bba0 |
continue;
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
--
|
|
|
05bba0 |
1.8.3.1
|
|
|
05bba0 |
|