[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 02/20] qcow2: Prevent allocating L2 tables at offset
From: |
Max Reitz |
Subject: |
[Qemu-devel] [PULL 02/20] qcow2: Prevent allocating L2 tables at offset 0 |
Date: |
Tue, 14 Nov 2017 18:23:59 +0100 |
From: Alberto Garcia <address@hidden>
If the refcount data is corrupted then we can end up trying to
allocate a new L2 table at offset 0 in the image, triggering an
assertion in the qcow2 cache that would crash QEMU:
qcow2_cache_entry_mark_dirty: Assertion `c->entries[i].offset != 0' failed
This patch adds an explicit check for this scenario and a new test
case.
Signed-off-by: Alberto Garcia <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
Message-id: address@hidden
Signed-off-by: Max Reitz <address@hidden>
---
block/qcow2-cluster.c | 8 ++++++++
tests/qemu-iotests/060 | 7 +++++++
tests/qemu-iotests/060.out | 6 ++++++
3 files changed, 21 insertions(+)
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index fb10e26068..2e072ed155 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -278,6 +278,14 @@ static int l2_allocate(BlockDriverState *bs, int l1_index,
uint64_t **table)
goto fail;
}
+ /* If we're allocating the table at offset 0 then something is wrong */
+ if (l2_offset == 0) {
+ qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
+ "allocation of L2 table at offset 0");
+ ret = -EIO;
+ goto fail;
+ }
+
ret = qcow2_cache_flush(bs, s->refcount_block_cache);
if (ret < 0) {
goto fail;
diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060
index dead26aeaf..40f85cc216 100755
--- a/tests/qemu-iotests/060
+++ b/tests/qemu-iotests/060
@@ -253,6 +253,13 @@ poke_file "$TEST_IMG" "$rt_offset"
"\x00\x00\x00\x00\x00\x00\x00\x00"
# causing a refcount block to be allocated at offset 0
$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
+echo
+echo "=== Testing empty refcount block ==="
+echo
+_make_test_img 64M
+poke_file "$TEST_IMG" "$rb_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
+$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
+
# success, all done
echo "*** done"
rm -f $seq.full
diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out
index 872719009c..5b8b518486 100644
--- a/tests/qemu-iotests/060.out
+++ b/tests/qemu-iotests/060.out
@@ -189,4 +189,10 @@ wrote 65536/65536 bytes at offset 0
64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
qcow2: Marking image as corrupt: Preventing invalid allocation of refcount
block at offset 0; further corruption events will be suppressed
write failed: Input/output error
+
+=== Testing empty refcount block ===
+
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
+qcow2: Marking image as corrupt: Preventing invalid allocation of L2 table at
offset 0; further corruption events will be suppressed
+write failed: Input/output error
*** done
--
2.13.6
- [Qemu-devel] [PULL 00/20] Block patches for 2.11.0-rc1, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 01/20] qcow2: Prevent allocating refcount blocks at offset 0, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 02/20] qcow2: Prevent allocating L2 tables at offset 0,
Max Reitz <=
- [Qemu-devel] [PULL 03/20] qcow2: Prevent allocating compressed clusters at offset 0, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 05/20] qcow2: Add iotest for an image with header.refcount_table_offset == 0, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 04/20] qcow2: Don't open images with header.refcount_table_clusters == 0, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 06/20] qcow2: Add iotest for an empty refcount table, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 07/20] qcow2: Assert that the crypto header does not overlap other metadata, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 09/20] iotests: Add missing 'blkdebug::' in 040, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 08/20] iotests: Make 030 less flaky, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 10/20] iotests: Make 055 less flaky, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 11/20] iotests: Make 083 less flaky, Max Reitz, 2017/11/14
- [Qemu-devel] [PULL 12/20] iotests: Make 136 less flaky, Max Reitz, 2017/11/14