[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 18/47] qcow2: Fix theoretical corruption in store_bitmap() error
From: |
Michael Tokarev |
Subject: |
[PATCH 18/47] qcow2: Fix theoretical corruption in store_bitmap() error path |
Date: |
Wed, 8 Mar 2023 19:57:21 +0300 |
From: Kevin Wolf <kwolf@redhat.com>
In order to write the bitmap table to the image file, it is converted to
big endian. If the write fails, it is passed to clear_bitmap_table() to
free all of the clusters it had allocated before. However, if we don't
convert it back to native endianness first, we'll free things at a wrong
offset.
In practical terms, the offsets will be so high that we won't actually
free any allocated clusters, but just run into an error, but in theory
this can cause image corruption.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20230112191454.169353-2-kwolf@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit b03dd9613bcf8fe948581b2b3585510cb525c382)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
block/qcow2-bitmap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index bcad567c0c..3dff99ba06 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -115,7 +115,7 @@ static int update_header_sync(BlockDriverState *bs)
return bdrv_flush(bs->file->bs);
}
-static inline void bitmap_table_to_be(uint64_t *bitmap_table, size_t size)
+static inline void bitmap_table_bswap_be(uint64_t *bitmap_table, size_t size)
{
size_t i;
@@ -1401,9 +1401,10 @@ static int store_bitmap(BlockDriverState *bs,
Qcow2Bitmap *bm, Error **errp)
goto fail;
}
- bitmap_table_to_be(tb, tb_size);
+ bitmap_table_bswap_be(tb, tb_size);
ret = bdrv_pwrite(bs->file, tb_offset, tb_size * sizeof(tb[0]), tb, 0);
if (ret < 0) {
+ bitmap_table_bswap_be(tb, tb_size);
error_setg_errno(errp, -ret, "Failed to write bitmap '%s' to file",
bm_name);
goto fail;
--
2.30.2
- [RFC PATCH 00/47] Patch Round-up for stable 7.2.1, Michael Tokarev, 2023/03/08
- [PATCH 07/47] target/riscv: Set pc_succ_insn for !rvc illegal insn, Michael Tokarev, 2023/03/08
- [PATCH 10/47] hw/nvme: fix missing cq eventidx update, Michael Tokarev, 2023/03/08
- [PATCH 06/47] meson: accept relative symlinks in "meson introspect --installed" data, Michael Tokarev, 2023/03/08
- [PATCH 02/47] vhost: fix vq dirty bitmap syncing when vIOMMU is enabled, Michael Tokarev, 2023/03/08
- [PATCH 05/47] target/arm: fix handling of HLT semihosting in system mode, Michael Tokarev, 2023/03/08
- [PATCH 13/47] target/arm: allow writes to SCR_EL3.HXEn bit when FEAT_HCX is enabled, Michael Tokarev, 2023/03/08
- [PATCH 14/47] target/arm: Fix in_debug path in S1_ptw_translate, Michael Tokarev, 2023/03/08
- [PATCH 12/47] target/arm: Fix sve_probe_page, Michael Tokarev, 2023/03/08
- [PATCH 11/47] configure: fix GLIB_VERSION for cross-compilation, Michael Tokarev, 2023/03/08
- [PATCH 18/47] qcow2: Fix theoretical corruption in store_bitmap() error path,
Michael Tokarev <=
- [PATCH 16/47] migration/ram: Fix error handling in ram_write_tracking_start(), Michael Tokarev, 2023/03/08
- [PATCH 22/47] target/i386: Fix C flag for BLSI, BLSMSK, BLSR, Michael Tokarev, 2023/03/08
- [PATCH 17/47] migration/ram: Fix populate_read_range(), Michael Tokarev, 2023/03/08
- [PATCH 15/47] target/arm: Fix physical address resolution for Stage2, Michael Tokarev, 2023/03/08
- [PATCH 20/47] tests/tcg/i386: Introduce and use reg_t consistently, Michael Tokarev, 2023/03/08
- [PATCH 19/47] block: fix detect-zeroes= with BDRV_REQ_REGISTERED_BUF, Michael Tokarev, 2023/03/08
- [PATCH 24/47] target/i386: Fix BZHI instruction, Michael Tokarev, 2023/03/08
- [PATCH 21/47] target/i386: Fix BEXTR instruction, Michael Tokarev, 2023/03/08
- [PATCH 23/47] target/i386: fix ADOX followed by ADCX, Michael Tokarev, 2023/03/08
- [PATCH 26/47] hw/smbios: fix field corruption in type 4 table, Michael Tokarev, 2023/03/08