diff options
| author | Alberto Garcia <berto@igalia.com> | 2017-11-03 16:18:50 +0200 |
|---|---|---|
| committer | Max Reitz <mreitz@redhat.com> | 2017-11-14 18:06:25 +0100 |
| commit | 6bf45d59f98c898b7d7997a333765c8ee41236ea (patch) | |
| tree | 16ac6eaddeef14fc04cbe924d39119ba797bd69e /block | |
| parent | 191b5fbfa66e5b23e2150f3c6981d30eb84418a9 (diff) | |
| download | qemu-6bf45d59f98c898b7d7997a333765c8ee41236ea.zip qemu-6bf45d59f98c898b7d7997a333765c8ee41236ea.tar.gz qemu-6bf45d59f98c898b7d7997a333765c8ee41236ea.tar.bz2 | |
qcow2: Prevent allocating refcount blocks at offset 0
Each entry in the qcow2 cache contains an offset field indicating the
location of the data in the qcow2 image. If the offset is 0 then it
means that the entry contains no data and is available to be used when
needed.
Because of that it is not possible to store in the cache the first
cluster of the qcow2 image (offset = 0). This is not a problem because
that cluster always contains the qcow2 header and we're not using this
cache for that.
However, if the qcow2 image is corrupted it can happen that we try to
allocate a new refcount block at offset 0, triggering this assertion
and crashing QEMU:
qcow2_cache_entry_mark_dirty: Assertion `c->entries[i].offset != 0' failed
This patch adds an explicit check for this scenario and a new test
case.
This problem was originally reported here:
https://bugs.launchpad.net/qemu/+bug/1728615
Reported-by: R.Nageswara Sastry <nasastry@in.ibm.com>
Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 92a2fadd10d58b423f269c1d1a309af161cdc73f.1509718618.git.berto@igalia.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/qcow2-refcount.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index aa3fd6c..9059996 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -367,6 +367,13 @@ static int alloc_refcount_block(BlockDriverState *bs, return new_block; } + /* If we're allocating the block at offset 0 then something is wrong */ + if (new_block == 0) { + qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " + "allocation of refcount block at offset 0"); + return -EIO; + } + #ifdef DEBUG_ALLOC2 fprintf(stderr, "qcow2: Allocate refcount block %d for %" PRIx64 " at %" PRIx64 "\n", |