From nobody Wed Apr 16 03:22:44 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1531238034076350.87663508378614; Tue, 10 Jul 2018 08:53:54 -0700 (PDT) Received: from localhost ([::1]:48507 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcuxc-0004tc-Ri for importer@patchew.org; Tue, 10 Jul 2018 11:53:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44382) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcund-0005BJ-Oy for qemu-devel@nongnu.org; Tue, 10 Jul 2018 11:43:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fcunc-0001g9-Fr for qemu-devel@nongnu.org; Tue, 10 Jul 2018 11:43:33 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:47624 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fcunX-0001cx-Eu; Tue, 10 Jul 2018 11:43:27 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 06810808255B; Tue, 10 Jul 2018 15:43:27 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-116-156.ams2.redhat.com [10.36.116.156]) by smtp.corp.redhat.com (Postfix) with ESMTP id 344442026D6B; Tue, 10 Jul 2018 15:43:26 +0000 (UTC) From: Kevin Wolf To: qemu-block@nongnu.org Date: Tue, 10 Jul 2018 17:42:50 +0200 Message-Id: <20180710154304.18304-11-kwolf@redhat.com> In-Reply-To: <20180710154304.18304-1-kwolf@redhat.com> References: <20180710154304.18304-1-kwolf@redhat.com> X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Tue, 10 Jul 2018 15:43:27 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Tue, 10 Jul 2018 15:43:27 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'kwolf@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PULL 10/24] block/blklogwrites: Make sure the log sector size is not too small X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, peter.maydell@linaro.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Ari Sundholm The sector size needs to be large enough to accommodate the data structures for the log super block and log write entries. This was previously not properly checked, which made it possible to cause QEMU to badly misbehave. Signed-off-by: Ari Sundholm Signed-off-by: Kevin Wolf --- block/blklogwrites.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/block/blklogwrites.c b/block/blklogwrites.c index 63bf6b34a9..efa2c7a66a 100644 --- a/block/blklogwrites.c +++ b/block/blklogwrites.c @@ -89,7 +89,10 @@ static inline uint32_t blk_log_writes_log2(uint32_t valu= e) =20 static inline bool blk_log_writes_sector_size_valid(uint32_t sector_size) { - return sector_size < (1ull << 24) && is_power_of_2(sector_size); + return is_power_of_2(sector_size) && + sector_size >=3D sizeof(struct log_write_super) && + sector_size >=3D sizeof(struct log_write_entry) && + sector_size < (1ull << 24); } =20 static uint64_t blk_log_writes_find_cur_log_sector(BdrvChild *log, --=20 2.13.6