yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-qcow2-fix-offset-overflow-in-qcow2_alloc_clusters_at.patch

9ae3a8
From ac19619fcd0eb051d57e5519a9fe8983b9e02fc0 Mon Sep 17 00:00:00 2001
9ae3a8
From: Max Reitz <mreitz@redhat.com>
9ae3a8
Date: Sat, 15 Feb 2014 16:03:48 +0100
9ae3a8
Subject: [PATCH 3/5] qcow2: fix offset overflow in qcow2_alloc_clusters_at()
9ae3a8
9ae3a8
RH-Author: Max Reitz <mreitz@redhat.com>
9ae3a8
Message-id: <1392480230-24011-3-git-send-email-mreitz@redhat.com>
9ae3a8
Patchwork-id: 57293
9ae3a8
O-Subject: [RHEL-7.0 qemu-kvm PATCH 2/4] qcow2: fix offset overflow in qcow2_alloc_clusters_at()
9ae3a8
Bugzilla: 1049176
9ae3a8
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
9ae3a8
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
9ae3a8
RH-Acked-by: Fam Zheng <famz@redhat.com>
9ae3a8
9ae3a8
From: Hu Tao <hutao@cn.fujitsu.com>
9ae3a8
9ae3a8
BZ: 1049176
9ae3a8
BZ: 1055848
9ae3a8
9ae3a8
When cluster size is big enough it can lead to an offset overflow
9ae3a8
in qcow2_alloc_clusters_at(). This patch fixes it.
9ae3a8
9ae3a8
The allocation is stopped each time at L2 table boundary
9ae3a8
(see handle_alloc()), so the possible maximum bytes could be
9ae3a8
9ae3a8
  2^(cluster_bits - 3 + cluster_bits)
9ae3a8
9ae3a8
cluster_bits - 3 is used to compute the number of entry by L2
9ae3a8
and the additional cluster_bits is to take into account each
9ae3a8
clusters referenced by the L2 entries.
9ae3a8
9ae3a8
so int is safe for cluster_bits<=17, unsafe otherwise.
9ae3a8
9ae3a8
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
9ae3a8
Reviewed-by: Max Reitz <mreitz@redhat.com>
9ae3a8
Reviewed-by: Benoit Canet <benoit@irqsave.net>
9ae3a8
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
9ae3a8
(cherry picked from commit 33304ec9fa484e765c6249673e09e1b7d49c5b85)
9ae3a8
9ae3a8
Signed-off-by: Max Reitz <mreitz@redhat.com>
9ae3a8
---
9ae3a8
 block/qcow2-refcount.c | 8 +++++++-
9ae3a8
 1 file changed, 7 insertions(+), 1 deletion(-)
9ae3a8
9ae3a8
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
---
9ae3a8
 block/qcow2-refcount.c |    8 +++++++-
9ae3a8
 1 files changed, 7 insertions(+), 1 deletions(-)
9ae3a8
9ae3a8
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
9ae3a8
index 389a837..09c638f 100644
9ae3a8
--- a/block/qcow2-refcount.c
9ae3a8
+++ b/block/qcow2-refcount.c
9ae3a8
@@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
9ae3a8
     BDRVQcowState *s = bs->opaque;
9ae3a8
     uint64_t cluster_index;
9ae3a8
     uint64_t old_free_cluster_index;
9ae3a8
-    int i, refcount, ret;
9ae3a8
+    uint64_t i;
9ae3a8
+    int refcount, ret;
9ae3a8
+
9ae3a8
+    assert(nb_clusters >= 0);
9ae3a8
+    if (nb_clusters == 0) {
9ae3a8
+        return 0;
9ae3a8
+    }
9ae3a8
 
9ae3a8
     /* Check how many clusters there are free */
9ae3a8
     cluster_index = offset >> s->cluster_bits;
9ae3a8
-- 
9ae3a8
1.7.1
9ae3a8