From nobody Thu Apr 25 19:32:00 2024 Delivered-To: importer@patchew.org Received-SPF: temperror (zoho.com: Error in retrieving data from DNS) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=temperror (zoho.com: Error in retrieving data from DNS) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (209.51.188.17 [209.51.188.17]) by mx.zohomail.com with SMTPS id 154964084445973.12778411420732; Fri, 8 Feb 2019 07:47:24 -0800 (PST) Received: from localhost ([127.0.0.1]:58588 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gs8Mw-00052v-95 for importer@patchew.org; Fri, 08 Feb 2019 10:47:12 -0500 Received: from eggs.gnu.org ([209.51.188.92]:55192) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gs8LN-0004SY-4H for qemu-devel@nongnu.org; Fri, 08 Feb 2019 10:45:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gs8L7-0000xL-4Q for qemu-devel@nongnu.org; Fri, 08 Feb 2019 10:45:23 -0500 Received: from fanzine.igalia.com ([91.117.99.155]:57306) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gs8L4-0000ph-Rf; Fri, 08 Feb 2019 10:45:16 -0500 Received: from 87-92-21-153.bb.dnainternet.fi ([87.92.21.153] helo=perseus.local) by fanzine.igalia.com with esmtpsa (Cipher TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim) id 1gs8Kz-0002pb-OJ; Fri, 08 Feb 2019 16:45:09 +0100 Received: from berto by perseus.local with local (Exim 4.89) (envelope-from ) id 1gs8Kl-0006g5-4w; Fri, 08 Feb 2019 17:44:55 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Message-Id:Date:Subject:Cc:To:From; bh=+SL4Arh8OLEmi3fK5/CZk+BHqIoeVo/kni7T4CZmQmU=; b=SuB9OlfCaWzmERd5rcpwCuqdSQcrg9edfeINjJiLQzVQqzqsJU4henH+i01AuAcJ1NDmYIS8mVs78N52tZ8wYe0MQfhHGKO3Kou3lP4RNGOwpyIvXhocZQsxrJ5SmDAyvOtbuNF0Dl6/P28EpPa96LIgDfZfpWlEJShFIgfFcEHw9JhxpxJG5SyG48fJk0eMdiel82XOMJ25lZgcrIQjdnSLJJlQDHzHw+7NlczBtSbRB37piLVlc1JCoSQHnowkMnRqf545X5/zQLCgpzSu+ntcd+FpkgJNRCTvMGgF/9vMrX7X/vAlBtSuyrjEymoeUJ9BqCMHJ3Sy64Wj+kwTlQ==; From: Alberto Garcia To: qemu-devel@nongnu.org Date: Fri, 8 Feb 2019 17:44:53 +0200 Message-Id: <20190208154453.25602-1-berto@igalia.com> X-Mailer: git-send-email 2.11.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x (no timestamps) [generic] [fuzzy] X-Received-From: 91.117.99.155 Subject: [Qemu-devel] [PATCH] qcow2: Assert that L2 table offsets fit in the L1 table X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Alberto Garcia , qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" L1 table entries have a field to store the offset of an L2 table. The rest of the bits of the entry are currently reserved except from bit 63, which stores the COPIED flag. The offset is always taken from the entry using L1E_OFFSET_MASK to ensure that we only use the bits that belong to that field. While that mask is used every time we read from the L1 table, it is never used when we write to it. Due to the limits set elsewhere in the code QEMU can never produce L2 table offsets that don't fit in that field so any such offset when allocating an L2 table would indicate a bug in QEMU. Signed-off-by: Alberto Garcia Reviewed-by: Eric Blake --- block/qcow2-cluster.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 30eca26c47..179aa2c728 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -285,6 +285,9 @@ static int l2_allocate(BlockDriverState *bs, int l1_ind= ex) goto fail; } =20 + /* The offset must fit in the offset field of the L1 table entry */ + assert((l2_offset & L1E_OFFSET_MASK) =3D=3D l2_offset); + /* If we're allocating the table at offset 0 then something is wrong */ if (l2_offset =3D=3D 0) { qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " --=20 2.11.0