From nobody Tue Apr 15 06:10:10 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (209.51.188.17 [209.51.188.17]) by mx.zohomail.com with SMTPS id 1549041075421581.1402511785797; Fri, 1 Feb 2019 09:11:15 -0800 (PST) Received: from localhost ([127.0.0.1]:58285 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gpcLN-00022R-Bj for importer@patchew.org; Fri, 01 Feb 2019 12:11:09 -0500 Received: from eggs.gnu.org ([209.51.188.92]:39186) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gpbo7-0007nq-Rl for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:36:50 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gpbo5-00006p-O3 for qemu-devel@nongnu.org; Fri, 01 Feb 2019 11:36:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60692) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gpbnz-0007om-Mb; Fri, 01 Feb 2019 11:36:39 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 82B571393DF; Fri, 1 Feb 2019 16:35:36 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-117-95.ams2.redhat.com [10.36.117.95]) by smtp.corp.redhat.com (Postfix) with ESMTP id 65C1B608C7; Fri, 1 Feb 2019 16:35:35 +0000 (UTC) From: Kevin Wolf To: qemu-block@nongnu.org Date: Fri, 1 Feb 2019 17:34:54 +0100 Message-Id: <20190201163518.31157-4-kwolf@redhat.com> In-Reply-To: <20190201163518.31157-1-kwolf@redhat.com> References: <20190201163518.31157-1-kwolf@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Fri, 01 Feb 2019 16:35:36 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 03/27] qcow2: Assert that refcount block offsets fit in the refcount table X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, peter.maydell@linaro.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Alberto Garcia Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved. The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field. While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU. Signed-off-by: Alberto Garcia Reviewed-by: Eric Blake Signed-off-by: Kevin Wolf --- block/qcow2-refcount.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 1c63ac244a..6f13d470d3 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -368,6 +368,9 @@ static int alloc_refcount_block(BlockDriverState *bs, return new_block; } =20 + /* The offset must fit in the offset field of the refcount table entry= */ + assert((new_block & REFT_OFFSET_MASK) =3D=3D new_block); + /* If we're allocating the block at offset 0 then something is wrong */ if (new_block =3D=3D 0) { qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " --=20 2.20.1