From nobody Sun Oct 5 20:59:19 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 150066214431535.02780028862571; Fri, 21 Jul 2017 11:35:44 -0700 (PDT) Received: from localhost ([::1]:44394 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dYcm5-0000wR-64 for importer@patchew.org; Fri, 21 Jul 2017 14:35:41 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39116) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dYcjU-0007VC-GU for qemu-devel@nongnu.org; Fri, 21 Jul 2017 14:33:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dYcjT-0003yf-L1 for qemu-devel@nongnu.org; Fri, 21 Jul 2017 14:33:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53518) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dYcjP-0003w7-5h; Fri, 21 Jul 2017 14:32:55 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 23CEAC00DB84; Fri, 21 Jul 2017 18:32:54 +0000 (UTC) Received: from red.redhat.com (ovpn-117-102.phx2.redhat.com [10.3.117.102]) by smtp.corp.redhat.com (Postfix) with ESMTP id 87A7452FDA; Fri, 21 Jul 2017 18:32:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 23CEAC00DB84 Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=eblake@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 23CEAC00DB84 From: Eric Blake To: qemu-devel@nongnu.org Date: Fri, 21 Jul 2017 13:32:43 -0500 Message-Id: <20170721183243.22706-3-eblake@redhat.com> In-Reply-To: <20170721183243.22706-1-eblake@redhat.com> References: <20170721183243.22706-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Fri, 21 Jul 2017 18:32:54 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 2/2] qcow2: Fix sector calculation in qcow2_measure() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, qemu-block@nongnu.org, stefanha@redhat.com, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" We used MAX() instead of the intended MIN() when computing how many sectors to view in the current loop iteration of qcow2_measure(), and passed in a value of INT_MAX sectors instead of our more usual limit of BDRV_REQUEST_MAX_SECTORS (the latter avoids 32-bit overflow on conversion to bytes). For small files, the bug is harmless: bdrv_get_block_status_above() clamps its *pnum answer to the BDS size, regardless of any insanely larger input request. However, for any file at least 2T in size, we can very easily end up going into an infinite loop (the maximum of 0x100000000 sectors and INT_MAX is a 64-bit quantity, which becomes 0 when assigned to int; once nb_sectors is 0, we never make progress). Signed-off-by: Eric Blake --- block/qcow2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/qcow2.c b/block/qcow2.c index 048df7e88b..d7c600b5a2 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -3670,8 +3670,8 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts= , BlockDriverState *in_bs, for (sector_num =3D 0; sector_num < ssize / BDRV_SECTOR_SIZE; sector_num +=3D pnum) { - int nb_sectors =3D MAX(ssize / BDRV_SECTOR_SIZE - sector_n= um, - INT_MAX); + int nb_sectors =3D MIN(ssize / BDRV_SECTOR_SIZE - sector_n= um, + BDRV_REQUEST_MAX_SECTORS); BlockDriverState *file; int64_t ret; --=20 2.13.3