aboutsummaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorStefano Garzarella <sgarzare@redhat.com>2021-10-05 18:11:56 +0200
committerVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>2021-10-05 18:56:20 +0200
commit8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf (patch)
tree9bc76e1402ddc47d2c6741ff3d226dccfe37d74c /block
parent9618c5badaa8eed25259cf095ff880efb939fbe7 (diff)
downloadqemu-8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf.zip
qemu-8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf.tar.gz
qemu-8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf.tar.bz2
block/backup: avoid integer overflow of `max-workers`
QAPI generates `struct BackupPerf` where `max-workers` value is stored in an `int64_t` variable. But block_copy_async(), and the underlying code, uses an `int` parameter. At the end that variable is used to initialize `max_busy_tasks` in block/aio_task.c causing the following assertion failure if a value greater than INT_MAX(2147483647) is used: ../block/aio_task.c:63: aio_task_pool_wait_one: Assertion `pool->busy_tasks > 0' failed. Let's check that `max-workers` doesn't exceed INT_MAX and print an error in that case. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2009310 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20211005161157.282396-2-sgarzare@redhat.com> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Diffstat (limited to 'block')
-rw-r--r--block/backup.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/block/backup.c b/block/backup.c
index 687d288..8b072db 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -407,8 +407,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
return NULL;
}
- if (perf->max_workers < 1) {
- error_setg(errp, "max-workers must be greater than zero");
+ if (perf->max_workers < 1 || perf->max_workers > INT_MAX) {
+ error_setg(errp, "max-workers must be between 1 and %d", INT_MAX);
return NULL;
}