From nobody Thu Nov 6 14:42:00 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1542207639837996.5736278624772; Wed, 14 Nov 2018 07:00:39 -0800 (PST) Received: from localhost ([::1]:60852 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gMwee-00029f-Uz for importer@patchew.org; Wed, 14 Nov 2018 10:00:32 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45827) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gMwdl-0001lQ-GN for qemu-devel@nongnu.org; Wed, 14 Nov 2018 09:59:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gMwdh-0002nL-En for qemu-devel@nongnu.org; Wed, 14 Nov 2018 09:59:37 -0500 Received: from fanzine.igalia.com ([91.117.99.155]:45547) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gMwdb-0002RC-IF; Wed, 14 Nov 2018 09:59:31 -0500 Received: from [194.100.51.2] (helo=perseus.local) by fanzine.igalia.com with esmtpsa (Cipher TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim) id 1gMwdW-0000DO-91; Wed, 14 Nov 2018 15:59:22 +0100 Received: from berto by perseus.local with local (Exim 4.89) (envelope-from ) id 1gMwdD-00058o-Us; Wed, 14 Nov 2018 16:59:03 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Message-Id:Date:Subject:Cc:To:From; bh=U0rSABeC849+3yJlxV+1u6UAmZiA5dFxbghZlaSsrd0=; b=KaMuIGdLTB744qWBreL2nd4x9/yOsh6aQ3JfOCz8uzIK3DIXN827mwkAGl7EURO+B6+aqhdcX2ngQBMgR81vYKPISErIaVwAWCVDl+2NWDaeYMSr0VC3mmNg2xjx7gPEycAsd1ENZRIRPzLVtyjXkINxPTZ0T45BvtfZ7NkFjC79oXdbSAemNEKCyC7LJvK8wfdnCJAxlEy2GYv4DaYaJRV4vIvNOjKnhi/Mo9y9oEcpQ+R3uqSrbwre1JGCkqlBgacuRm8o8FxqDOGft9CgIYWmQnfapW8kzWME1MFGfnKYOeB4iD/xh1Vj2lTmcjGzDoHkosgs6EiB9tpZgft/Zg==; From: Alberto Garcia To: qemu-devel@nongnu.org Date: Wed, 14 Nov 2018 16:58:57 +0200 Message-Id: <20181114145857.19720-1-berto@igalia.com> X-Mailer: git-send-email 2.11.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x (no timestamps) [generic] [fuzzy] X-Received-From: 91.117.99.155 Subject: [Qemu-devel] [PATCH v2] qcow2: Assert that refcount block offsets fit in the refcount table X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Alberto Garcia , qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved. The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field. While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU. Signed-off-by: Alberto Garcia Reviewed-by: Eric Blake --- v2: Add missing Signed-off-by: line --- block/qcow2-refcount.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 46082aeac1..31a2e1f845 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -367,6 +367,9 @@ static int alloc_refcount_block(BlockDriverState *bs, return new_block; } =20 + /* The offset must fit in the offset field of the refcount table entry= */ + assert((new_block & REFT_OFFSET_MASK) =3D=3D new_block); + /* If we're allocating the block at offset 0 then something is wrong */ if (new_block =3D=3D 0) { qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " --=20 2.11.0