From nobody Wed Nov 5 13:11:55 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=virtuozzo.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1534508871818456.2725731693881; Fri, 17 Aug 2018 05:27:51 -0700 (PDT) Received: from localhost ([::1]:33519 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fqdr4-0008I9-HJ for importer@patchew.org; Fri, 17 Aug 2018 08:27:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34908) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fqdly-0004Jx-EW for qemu-devel@nongnu.org; Fri, 17 Aug 2018 08:22:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fqdlx-0004YF-L9 for qemu-devel@nongnu.org; Fri, 17 Aug 2018 08:22:34 -0400 Received: from relay.sw.ru ([185.231.240.75]:52234) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fqdlx-0004Wy-A0; Fri, 17 Aug 2018 08:22:33 -0400 Received: from [10.28.8.145] (helo=kvm.sw.ru) by relay.sw.ru with esmtp (Exim 4.90_1) (envelope-from ) id 1fqdlu-0006lJ-4Q; Fri, 17 Aug 2018 15:22:30 +0300 From: Vladimir Sementsov-Ogievskiy To: qemu-devel@nongnu.org, qemu-block@nongnu.org Date: Fri, 17 Aug 2018 15:22:18 +0300 Message-Id: <20180817122219.16206-7-vsementsov@virtuozzo.com> X-Mailer: git-send-email 2.11.1 In-Reply-To: <20180817122219.16206-1-vsementsov@virtuozzo.com> References: <20180817122219.16206-1-vsementsov@virtuozzo.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 185.231.240.75 Subject: [Qemu-devel] [PATCH v2 6/7] block/qcow2-refcount: fix out-of-file L1 entries to be zero X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, den@openvz.org, vsementsov@virtuozzo.com, mreitz@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RDMRC_1 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Zero out corrupted L1 table entry, which reference L2 table out of underlying file. Zero L1 table entry means that "the L2 table and all clusters described by this L2 table are unallocated." Signed-off-by: Vladimir Sementsov-Ogievskiy --- block/qcow2-refcount.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index d9c8cd666b..3c004e5bfe 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -1647,6 +1647,29 @@ static int fix_l2_entry_to_zero(BlockDriverState *bs= , BdrvCheckResult *res, return ret; } =20 +/* Zero out L1 entry + * + * Returns: -errno if overlap check failed + * 0 if write failed + * 1 on success + */ +static int fix_l1_entry_to_zero(BlockDriverState *bs, BdrvCheckResult *res, + BdrvCheckMode fix, int64_t l1_offset, + int l1_index, bool active, + const char *fmt, ...) +{ + int ret; + int ign =3D active ? QCOW2_OL_ACTIVE_L2 : QCOW2_OL_INACTIVE_L2; + va_list args; + + va_start(args, fmt); + ret =3D fix_table_entry(bs, res, fix, "L1", l1_offset, l1_index, 0, ig= n, + fmt, args); + va_end(args); + + return ret; +} + /* * Increases the refcount in the given refcount table for the all clusters * referenced in the L2 table. While doing so, performs some checks on L2 @@ -1808,6 +1831,7 @@ static int check_refcounts_l1(BlockDriverState *bs, { BDRVQcow2State *s =3D bs->opaque; uint64_t *l1_table =3D NULL, l2_offset, l1_size2; + int64_t file_len; int i, ret; =20 l1_size2 =3D l1_size * sizeof(uint64_t); @@ -1837,12 +1861,32 @@ static int check_refcounts_l1(BlockDriverState *bs, be64_to_cpus(&l1_table[i]); } =20 + file_len =3D bdrv_getlength(bs->file->bs); + if (file_len < 0) { + ret =3D file_len; + goto fail; + } + /* Do the actual checks */ for(i =3D 0; i < l1_size; i++) { l2_offset =3D l1_table[i]; if (l2_offset) { /* Mark L2 table as used */ l2_offset &=3D L1E_OFFSET_MASK; + if (l2_offset >=3D file_len) { + ret =3D fix_l1_entry_to_zero( + bs, res, fix, l1_table_offset, i, active, + "l2 table offset out of file: offset 0x%" PRIx64, + l2_offset); + if (ret < 0) { + /* Something is seriously wrong, so abort checking + * this L1 table */ + goto fail; + } + + continue; + } + ret =3D qcow2_inc_refcounts_imrt(bs, res, refcount_table, refcount_table_= size, l2_offset, s->cluster_size); --=20 2.11.1