The sector size needs to be large enough to accommodate the data
structures for the log super block and log write entries. This was
previously not properly checked, which made it possible to cause
QEMU to badly misbehave.

Signed-off-by: Ari Sundholm <ari@tuxera.com>
---
 block/blklogwrites.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/block/blklogwrites.c b/block/blklogwrites.c
index 63bf6b3..efa2c7a 100644
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -89,7 +89,10 @@ static inline uint32_t blk_log_writes_log2(uint32_t value)
 
 static inline bool blk_log_writes_sector_size_valid(uint32_t sector_size)
 {
-    return sector_size < (1ull << 24) && is_power_of_2(sector_size);
+    return is_power_of_2(sector_size) &&
+        sector_size >= sizeof(struct log_write_super) &&
+        sector_size >= sizeof(struct log_write_entry) &&
+        sector_size < (1ull << 24);
 }
 
 static uint64_t blk_log_writes_find_cur_log_sector(BdrvChild *log,
-- 
2.7.4

Would there be a chance of getting this included in 3.0?

On 07/06/2018 03:00 PM, Ari Sundholm wrote:
> The sector size needs to be large enough to accommodate the data
> structures for the log super block and log write entries. This was
> previously not properly checked, which made it possible to cause
> QEMU to badly misbehave.
> 
> Signed-off-by: Ari Sundholm <ari@tuxera.com>
> ---
>   block/blklogwrites.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/block/blklogwrites.c b/block/blklogwrites.c
> index 63bf6b3..efa2c7a 100644
> --- a/block/blklogwrites.c
> +++ b/block/blklogwrites.c
> @@ -89,7 +89,10 @@ static inline uint32_t blk_log_writes_log2(uint32_t value)
>   
>   static inline bool blk_log_writes_sector_size_valid(uint32_t sector_size)
>   {
> -    return sector_size < (1ull << 24) && is_power_of_2(sector_size);
> +    return is_power_of_2(sector_size) &&
> +        sector_size >= sizeof(struct log_write_super) &&
> +        sector_size >= sizeof(struct log_write_entry) &&
> +        sector_size < (1ull << 24);
>   }
>   
>   static uint64_t blk_log_writes_find_cur_log_sector(BdrvChild *log,
> 

Am 09.07.2018 um 17:01 hat Ari Sundholm geschrieben:
> Would there be a chance of getting this included in 3.0?

Sure, this is clearly a bug fix.

Thanks, applied to the block branch.

Kevin

> On 07/06/2018 03:00 PM, Ari Sundholm wrote:
> > The sector size needs to be large enough to accommodate the data
> > structures for the log super block and log write entries. This was
> > previously not properly checked, which made it possible to cause
> > QEMU to badly misbehave.
> > 
> > Signed-off-by: Ari Sundholm <ari@tuxera.com>
> > ---
> >   block/blklogwrites.c | 5 ++++-
> >   1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/block/blklogwrites.c b/block/blklogwrites.c
> > index 63bf6b3..efa2c7a 100644
> > --- a/block/blklogwrites.c
> > +++ b/block/blklogwrites.c
> > @@ -89,7 +89,10 @@ static inline uint32_t blk_log_writes_log2(uint32_t value)
> >   static inline bool blk_log_writes_sector_size_valid(uint32_t sector_size)
> >   {
> > -    return sector_size < (1ull << 24) && is_power_of_2(sector_size);
> > +    return is_power_of_2(sector_size) &&
> > +        sector_size >= sizeof(struct log_write_super) &&
> > +        sector_size >= sizeof(struct log_write_entry) &&
> > +        sector_size < (1ull << 24);
> >   }
> >   static uint64_t blk_log_writes_find_cur_log_sector(BdrvChild *log,
> > 
>