aboutsummaryrefslogtreecommitdiff
path: root/scsi
diff options
context:
space:
mode:
authorEric Blake <eblake@redhat.com>2019-01-17 13:36:41 -0600
committerEric Blake <eblake@redhat.com>2019-01-21 15:49:51 -0600
commit4485936b6de20afa38138e9d1e8ffed88cf0be73 (patch)
tree94e0bdc2e9397475d380824e3d11ef07857e1bb4 /scsi
parent86b7f6771f0cd1552791d1bfc2bdebd65cf967a3 (diff)
downloadqemu-4485936b6de20afa38138e9d1e8ffed88cf0be73.zip
qemu-4485936b6de20afa38138e9d1e8ffed88cf0be73.tar.gz
qemu-4485936b6de20afa38138e9d1e8ffed88cf0be73.tar.bz2
qemu-nbd: Sanity check partition bounds
When the user requests a partition, we were using data read from the disk as disk offsets without a bounds check. We got lucky that even when computed offsets are out-of-bounds, blk_pread() will gracefully catch the error later (so I don't think a malicious image can crash or exploit qemu-nbd, and am not treating this as a security flaw), but it's better to flag the problem up front than to risk permanent EIO death of the block device down the road. The new bounds check adds an assertion that will never fail, but rather exists to help the compiler see that adding two positive 41-bit values (given MBR constraints) can't overflow 64-bit off_t. Using off_t to represent a partition length is a bit of a misnomer; a later patch will update to saner types, but it is left separate in case the bounds check needs to be backported in isolation. Also, note that the partition code blindly overwrites any non-zero offset passed in by the user; so for now, make the -o/-P combo an error for less confusion. In the future, we may let -o and -P work together (selecting a subset of a partition); so it is okay that an explicit '-o 0' behaves no differently from omitting -o. This can be tested with nbdkit: $ echo hi > file $ nbdkit -fv --filter=truncate partitioning file truncate=64k Pre-patch: $ qemu-nbd -p 10810 -P 1 -f raw nbd://localhost:10809 & $ qemu-io -f raw nbd://localhost:10810 qemu-io> r -v 0 1 Disconnect client, due to: Failed to send reply: reading from file failed: Input/output error Connection closed read failed: Input/output error qemu-io> q [1]+ Done qemu-nbd -p 10810 -P 1 -f raw nbd://localhost:10809 Post-patch: $ qemu-nbd -p 10810 -P 1 -f raw nbd://localhost:10809 qemu-nbd: Discovered partition 1 at offset 1048576 size 512, but size exceeds file length 65536 Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Richard W.M. Jones <rjones@redhat.com> Message-Id: <20190117193658.16413-5-eblake@redhat.com>
Diffstat (limited to 'scsi')
0 files changed, 0 insertions, 0 deletions