The following changes since commit dfaecc04c46d298e9ee81bd0ca96d8754f1c27ed:

Merge tag 'pull-riscv-to-apply-20250407-1' of https://github.com/alistair23/qemu into staging (2025-04-07 09:18:33 -0400)

are available in the Git repository at:

https://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to f8222bfba3409a3ce09c191941127a8cf2c7e623:

test-bdrv-drain: Fix data races (2025-04-08 15:00:01 +0200)

Block layer patches

- scsi-disk: Apply error policy for host_status errors again

- qcow2: Fix qemu-img info crash with missing crypto header

- qemu-img bench: Fix division by zero for zero-sized images

- test-bdrv-drain: Fix data races

Denis Rastyogin (1):

qemu-img: fix division by zero in bench_cb() for zero-sized images

Kevin Wolf (2):

qcow2: Don't crash qemu-img info with missing crypto header

scsi-disk: Apply error policy for host_status errors again

Vitalii Mordan (1):

test-bdrv-drain: Fix data races

include/qemu/job.h | 3 ++

block/qcow2.c | 4 +-

hw/scsi/scsi-disk.c | 39 +++++++++-----

job.c | 6 +++

qemu-img.c | 6 ++-

tests/unit/test-bdrv-drain.c | 32 +++++++-----

tests/qemu-iotests/tests/qcow2-encryption | 75 +++++++++++++++++++++++++++

tests/qemu-iotests/tests/qcow2-encryption.out | 32 ++++++++++++

8 files changed, 167 insertions(+), 30 deletions(-)

create mode 100755 tests/qemu-iotests/tests/qcow2-encryption

create mode 100644 tests/qemu-iotests/tests/qcow2-encryption.out

From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

This commit fixes a division by zero error in the bench_cb() function

that occurs when using the bench command with a zero-sized image.

The issue arises because b->image_size can be zero, leading to a

division by zero in the modulo operation (b->offset %= b->image_size).

This patch adds a check for b->image_size == 0 and resets b->offset

to 0 in such cases, preventing the error.

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>

Message-ID: <20250318101933.255617-1-gerben@altlinux.org>

Reviewed-by: Kevin Wolf <kwolf@redhat.com>

qemu-img.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c

--- a/qemu-img.c

+++ b/qemu-img.c

@@ -XXX,XX +XXX,XX @@ static void bench_cb(void *opaque, int ret)

*/

b->in_flight++;

b->offset += b->step;

- b->offset %= b->image_size;

+ if (b->image_size == 0) {

+ b->offset = 0;

+ b->offset %= b->image_size;

if (b->write) {

acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b);

} else {

2.49.0

qcow2_refresh_limits() assumes that s->crypto is non-NULL whenever

bs->encrypted is true. This is actually not the case: qcow2_do_open()

allows to open an image with a missing crypto header for BDRV_O_NO_IO,

and then bs->encrypted is true, but s->crypto is still NULL.

It doesn't make sense to open an invalid image, so remove the exception

for BDRV_O_NO_IO. This catches the problem early and any code that makes

the same assumption is safe now.

At the same time, in the name of defensive programming, we shouldn't

make the assumption in the first place. Let qcow2_refresh_limits() check

s->crypto rather than bs->encrypted. If s->crypto is NULL, it also can't

make any requirement on request alignment.

Finally, start a qcow2-encryption test case that only serves as a

regression test for this crash for now.

Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru>

Reported-by: Denis Rastyogin <gerben@altlinux.org>

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Message-ID: <20250318201143.70657-1-kwolf@redhat.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

block/qcow2.c | 4 +-

tests/qemu-iotests/tests/qcow2-encryption | 75 +++++++++++++++++++

tests/qemu-iotests/tests/qcow2-encryption.out | 32 ++++++++

3 files changed, 109 insertions(+), 2 deletions(-)

create mode 100755 tests/qemu-iotests/tests/qcow2-encryption

create mode 100644 tests/qemu-iotests/tests/qcow2-encryption.out

@@ -XXX,XX +XXX,XX @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,

ret = -EINVAL;

goto fail;

}

- } else if (!(flags & BDRV_O_NO_IO)) {

+ } else {

error_setg(errp, "Missing CRYPTO header for crypt method %d",

s->crypt_method_header);

ret = -EINVAL;

@@ -XXX,XX +XXX,XX @@ static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)

- if (bs->encrypted) {

+ if (s->crypto) {

/* Encryption works on a sector granularity */

bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);

diff --git a/tests/qemu-iotests/tests/qcow2-encryption b/tests/qemu-iotests/tests/qcow2-encryption

new file mode 100755

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/qemu-iotests/tests/qcow2-encryption

@@ -XXX,XX +XXX,XX @@

+#!/usr/bin/env bash

+# group: rw quick

+#

+# Test case for encryption support in qcow2

+#

+# Copyright (C) 2025 Red Hat, Inc.

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; either version 2 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program. If not, see <http://www.gnu.org/licenses/>.

+#

+

+# creator

+owner=kwolf@redhat.com

+

+seq="$(basename $0)"

+echo "QA output created by $seq"

+

+status=1    # failure is the default!

+

+_cleanup()

+{

+    _cleanup_test_img

+}

+trap "_cleanup; exit \$status" 0 1 2 3 15

+

+# get standard environment, filters and checks

+. ../common.rc

+. ../common.filter

+

+# This tests qcow2-specific low-level functionality

+_supported_fmt qcow2

+_supported_proto file

+_require_working_luks

+

+IMG_SIZE=64M

+

+echo

+echo "=== Create an encrypted image ==="

+echo

+

+_make_test_img --object secret,id=sec0,data=123456 -o encrypt.format=luks,encrypt.key-secret=sec0 $IMG_SIZE

+$PYTHON ../qcow2.py "$TEST_IMG" dump-header-exts

+_img_info

+$QEMU_IMG check \

+ --object secret,id=sec0,data=123456 \

+ --image-opts file.filename="$TEST_IMG",encrypt.key-secret=sec0 \

+ | _filter_qemu_img_check

+

+echo

+echo "=== Remove the header extension ==="

+echo

+

+$PYTHON ../qcow2.py "$TEST_IMG" del-header-ext 0x0537be77

+$PYTHON ../qcow2.py "$TEST_IMG" dump-header-exts

+_img_info

+$QEMU_IMG check \

+ --object secret,id=sec0,data=123456 \

+ --image-opts file.filename="$TEST_IMG",encrypt.key-secret=sec0 2>&1 \

+ | _filter_qemu_img_check \

+ | _filter_testdir

+

+# success, all done

+echo "*** done"

+rm -f $seq.full

+status=0

diff --git a/tests/qemu-iotests/tests/qcow2-encryption.out b/tests/qemu-iotests/tests/qcow2-encryption.out

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/qemu-iotests/tests/qcow2-encryption.out

@@ -XXX,XX +XXX,XX @@

+QA output created by qcow2-encryption

+

+=== Create an encrypted image ===

+

+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864

+Header extension:

+magic 0x537be77 (Crypto header)

+length 16

+data <binary>

+

+Header extension:

+magic 0x6803f857 (Feature table)

+length 384

+data <binary>

+

+image: TEST_DIR/t.IMGFMT

+file format: IMGFMT

+virtual size: 64 MiB (67108864 bytes)

+encrypted: yes

+cluster_size: 65536

+No errors were found on the image.

+

+=== Remove the header extension ===

+

+Header extension:

+magic 0x6803f857 (Feature table)

+length 384

+data <binary>

+

+qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Missing CRYPTO header for crypt method 2

+qemu-img: Could not open 'file.filename=TEST_DIR/t.qcow2,encrypt.key-secret=sec0': Missing CRYPTO header for crypt method 2

+*** done

2.49.0