From nobody Wed Nov 5 02:40:01 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1500906849744631.1414835108733; Mon, 24 Jul 2017 07:34:09 -0700 (PDT) Received: from localhost ([::1]:55184 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dZeQx-0002aI-9l for importer@patchew.org; Mon, 24 Jul 2017 10:34:07 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45502) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dZePO-0001gP-A5 for qemu-devel@nongnu.org; Mon, 24 Jul 2017 10:32:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dZePN-00078g-HU for qemu-devel@nongnu.org; Mon, 24 Jul 2017 10:32:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45716) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dZePL-00075l-8V; Mon, 24 Jul 2017 10:32:27 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 3C85C356DA; Mon, 24 Jul 2017 14:32:26 +0000 (UTC) Received: from noname.str.redhat.com (dhcp-192-175.str.redhat.com [10.33.192.175]) by smtp.corp.redhat.com (Postfix) with ESMTP id 714F860A9B; Mon, 24 Jul 2017 14:32:25 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 3C85C356DA Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=kwolf@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 3C85C356DA From: Kevin Wolf To: qemu-block@nongnu.org Date: Mon, 24 Jul 2017 16:32:08 +0200 Message-Id: <1500906730-26467-4-git-send-email-kwolf@redhat.com> In-Reply-To: <1500906730-26467-1-git-send-email-kwolf@redhat.com> References: <1500906730-26467-1-git-send-email-kwolf@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 24 Jul 2017 14:32:26 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 3/5] qcow2: Fix sector calculation in qcow2_measure() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Eric Blake We used MAX() instead of the intended MIN() when computing how many sectors to view in the current loop iteration of qcow2_measure(), and passed in a value of INT_MAX sectors instead of our more usual limit of BDRV_REQUEST_MAX_SECTORS (the latter avoids 32-bit overflow on conversion to bytes). For small files, the bug is harmless: bdrv_get_block_status_above() clamps its *pnum answer to the BDS size, regardless of any insanely larger input request. However, for any file at least 2T in size, we can very easily end up going into an infinite loop (the maximum of 0x100000000 sectors and INT_MAX is a 64-bit quantity, which becomes 0 when assigned to int; once nb_sectors is 0, we never make progress). Signed-off-by: Eric Blake Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf --- block/qcow2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/qcow2.c b/block/qcow2.c index d5790af..90efa44 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -3669,8 +3669,8 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts= , BlockDriverState *in_bs, for (sector_num =3D 0; sector_num < ssize / BDRV_SECTOR_SIZE; sector_num +=3D pnum) { - int nb_sectors =3D MAX(ssize / BDRV_SECTOR_SIZE - sector_n= um, - INT_MAX); + int nb_sectors =3D MIN(ssize / BDRV_SECTOR_SIZE - sector_n= um, + BDRV_REQUEST_MAX_SECTORS); BlockDriverState *file; int64_t ret; =20 --=20 1.8.3.1