From nobody Tue Feb 10 12:57:39 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1502137916422397.5903001318093; Mon, 7 Aug 2017 13:31:56 -0700 (PDT) Received: from localhost ([::1]:39453 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1deogt-000858-6m for importer@patchew.org; Mon, 07 Aug 2017 16:31:55 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45885) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1deofa-0007II-8L for qemu-devel@nongnu.org; Mon, 07 Aug 2017 16:30:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1deofU-00048X-MI for qemu-devel@nongnu.org; Mon, 07 Aug 2017 16:30:34 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60472) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1deofJ-0003xb-Jo; Mon, 07 Aug 2017 16:30:17 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 92AB4356F3; Mon, 7 Aug 2017 20:30:16 +0000 (UTC) Received: from red.redhat.com (ovpn-120-43.rdu2.redhat.com [10.10.120.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9DF365D96D; Mon, 7 Aug 2017 20:30:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 92AB4356F3 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=eblake@redhat.com From: Eric Blake To: qemu-devel@nongnu.org Date: Mon, 7 Aug 2017 15:30:05 -0500 Message-Id: <20170807203007.19033-3-eblake@redhat.com> In-Reply-To: <20170807203007.19033-1-eblake@redhat.com> References: <20170807203007.19033-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 07 Aug 2017 20:30:16 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 2/4] qcow: Check failure of bdrv_getlength() and bdrv_truncate() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, armbru@redhat.com, qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This also requires changing the return type of get_cluster_offset() and adjusting all callers. Use osdep.h macros instead of open-coded rounding while in the area. Reported-by: Markus Armbruster Signed-off-by: Eric Blake Reviewed-by: Jeff Cody Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- block/qcow.c | 64 ++++++++++++++++++++++++++++++++++++++++++--------------= ---- 1 file changed, 45 insertions(+), 19 deletions(-) diff --git a/block/qcow.c b/block/qcow.c index c08cdc4a7b..937023d447 100644 --- a/block/qcow.c +++ b/block/qcow.c @@ -347,16 +347,17 @@ static int qcow_reopen_prepare(BDRVReopenState *state, * 'compressed_size'. 'compressed_size' must be > 0 and < * cluster_size * - * return 0 if not allocated. + * return 0 if not allocated, -errno on failure. */ -static uint64_t get_cluster_offset(BlockDriverState *bs, - uint64_t offset, int allocate, - int compressed_size, - int n_start, int n_end) +static int64_t get_cluster_offset(BlockDriverState *bs, + uint64_t offset, int allocate, + int compressed_size, + int n_start, int n_end) { BDRVQcowState *s =3D bs->opaque; int min_index, i, j, l1_index, l2_index; - uint64_t l2_offset, *l2_table, cluster_offset, tmp; + int64_t l2_offset, cluster_offset; + uint64_t *l2_table, tmp; uint32_t min_count; int new_l2_table; @@ -368,8 +369,11 @@ static uint64_t get_cluster_offset(BlockDriverState *b= s, return 0; /* allocate a new l2 entry */ l2_offset =3D bdrv_getlength(bs->file->bs); + if (l2_offset < 0) { + return l2_offset; + } /* round to cluster size */ - l2_offset =3D (l2_offset + s->cluster_size - 1) & ~(s->cluster_siz= e - 1); + l2_offset =3D QEMU_ALIGN_UP(l2_offset, s->cluster_size); /* update the L1 entry */ s->l1_table[l1_index] =3D l2_offset; tmp =3D cpu_to_be64(l2_offset); @@ -430,8 +434,10 @@ static uint64_t get_cluster_offset(BlockDriverState *b= s, if (decompress_cluster(bs, cluster_offset) < 0) return 0; cluster_offset =3D bdrv_getlength(bs->file->bs); - cluster_offset =3D (cluster_offset + s->cluster_size - 1) & - ~(s->cluster_size - 1); + if (cluster_offset < 0) { + return cluster_offset; + } + cluster_offset =3D QEMU_ALIGN_UP(cluster_offset, s->cluster_si= ze); /* write the cluster content */ if (bdrv_pwrite(bs->file, cluster_offset, s->cluster_cache, s->cluster_size) !=3D @@ -439,12 +445,19 @@ static uint64_t get_cluster_offset(BlockDriverState *= bs, return -1; } else { cluster_offset =3D bdrv_getlength(bs->file->bs); + if (cluster_offset < 0) { + return cluster_offset; + } if (allocate =3D=3D 1) { + int ret; + /* round to cluster size */ - cluster_offset =3D (cluster_offset + s->cluster_size - 1) & - ~(s->cluster_size - 1); - bdrv_truncate(bs->file, cluster_offset + s->cluster_size, - PREALLOC_MODE_OFF, NULL); + cluster_offset =3D QEMU_ALIGN_UP(cluster_offset, s->cluste= r_size); + ret =3D bdrv_truncate(bs->file, cluster_offset + s->cluste= r_size, + PREALLOC_MODE_OFF, NULL); + if (ret < 0) { + return ret; + } /* if encrypted, we must initialize the cluster content which won't be written */ if (bs->encrypted && @@ -491,11 +504,14 @@ static int64_t coroutine_fn qcow_co_get_block_status(= BlockDriverState *bs, { BDRVQcowState *s =3D bs->opaque; int index_in_cluster, n; - uint64_t cluster_offset; + int64_t cluster_offset; qemu_co_mutex_lock(&s->lock); cluster_offset =3D get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0); qemu_co_mutex_unlock(&s->lock); + if (cluster_offset < 0) { + return cluster_offset; + } index_in_cluster =3D sector_num & (s->cluster_sectors - 1); n =3D s->cluster_sectors - index_in_cluster; if (n > nb_sectors) @@ -567,7 +583,7 @@ static coroutine_fn int qcow_co_readv(BlockDriverState = *bs, int64_t sector_num, BDRVQcowState *s =3D bs->opaque; int index_in_cluster; int ret =3D 0, n; - uint64_t cluster_offset; + int64_t cluster_offset; struct iovec hd_iov; QEMUIOVector hd_qiov; uint8_t *buf; @@ -588,8 +604,10 @@ static coroutine_fn int qcow_co_readv(BlockDriverState= *bs, int64_t sector_num, while (nb_sectors !=3D 0) { /* prepare next request */ - cluster_offset =3D get_cluster_offset(bs, sector_num << 9, - 0, 0, 0, 0); + cluster_offset =3D get_cluster_offset(bs, sector_num << 9, 0, 0, 0= , 0); + if (cluster_offset < 0) { + return cluster_offset; + } index_in_cluster =3D sector_num & (s->cluster_sectors - 1); n =3D s->cluster_sectors - index_in_cluster; if (n > nb_sectors) { @@ -670,7 +688,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState= *bs, int64_t sector_num, { BDRVQcowState *s =3D bs->opaque; int index_in_cluster; - uint64_t cluster_offset; + int64_t cluster_offset; int ret =3D 0, n; struct iovec hd_iov; QEMUIOVector hd_qiov; @@ -704,6 +722,10 @@ static coroutine_fn int qcow_co_writev(BlockDriverStat= e *bs, int64_t sector_num, cluster_offset =3D get_cluster_offset(bs, sector_num << 9, 1, 0, index_in_cluster, index_in_cluster + n); + if (cluster_offset < 0) { + ret =3D cluster_offset; + break; + } if (!cluster_offset || (cluster_offset & 511) !=3D 0) { ret =3D -EIO; break; @@ -949,7 +971,7 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64= _t offset, z_stream strm; int ret, out_len; uint8_t *buf, *out_buf; - uint64_t cluster_offset; + int64_t cluster_offset; buf =3D qemu_blockalign(bs, s->cluster_size); if (bytes !=3D s->cluster_size) { @@ -1003,6 +1025,10 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uin= t64_t offset, qemu_co_mutex_lock(&s->lock); cluster_offset =3D get_cluster_offset(bs, offset, 2, out_len, 0, 0); qemu_co_mutex_unlock(&s->lock); + if (cluster_offset < 0) { + ret =3D cluster_offset; + goto fail; + } if (cluster_offset =3D=3D 0) { ret =3D -EIO; goto fail; --=20 2.13.4