Series comparison

-[PULL for-9.0 0/1] Block patches
+[PULL 0/1] Block patches
-The following changes since commit 786fd793b81410fb2a28914315e2f05d2ff6733b:
+The following changes since commit 871af84dd599fab68c8ed414d9ecbdb2bcfc5801:
-  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2024-04-03 12:52:03 +0100)
+  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2025-01-29 09:51:03 -0500)
 are available in the Git repository at:
   https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to bbdf9023665f409113cb07b463732861af63fb47:
+for you to fetch changes up to 58607752d173438994d28dea7e2c2587726663e6:
-  block/virtio-blk: Fix memory leak from virtio_blk_zone_report (2024-04-04 09:29:42 -0400)
+  parallels: fix ext_off assertion failure due to overflow (2025-01-30 15:22:28 -0500)
 ----------------------------------------------------------------
 Pull request
-Fix a memory leak in virtio-blk zone report emulation code when the request is
-invalid.
 ----------------------------------------------------------------
-Zheyu Ma (1):
+Denis Rastyogin (1):
-  block/virtio-blk: Fix memory leak from virtio_blk_zone_report
+  parallels: fix ext_off assertion failure due to overflow
- hw/block/virtio-blk.c | 3 ++-
+ block/parallels.c | 4 ++++
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+)
 --
-.44.0
+.48.1

-[PULL for-9.0 1/1] block/virtio-blk: Fix memory leak from virtio_blk_zone_report
+[PULL 1/1] parallels: fix ext_off assertion failure due to overflow
-From: Zheyu Ma <zheyuma97@gmail.com>
+From: Denis Rastyogin <gerben@altlinux.org>
-This modification ensures that in scenarios where the buffer size is
+This error was discovered by fuzzing qemu-img.
 insufficient for a zone report, the function will now properly set an
 error status and proceed to a cleanup label, instead of merely
 returning.
-The following ASAN log reveals it:
+When ph.ext_off has a sufficiently large value, the operation
 le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in
 parallels_read_format_extension() can cause an overflow in int64_t.
 This overflow triggers the assert(ext_off > 0)
 check in block/parallels-ext.c: parallels_read_format_extension(),
 leading to a crash.
-==1767400==ERROR: LeakSanitizer: detected memory leaks
+This commit adds a check to prevent overflow when shifting ph.ext_off
-Direct leak of 312 byte(s) in 1 object(s) allocated from:
+by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range.
     #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
     #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
     #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
     #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
     #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
     #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
     #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru>
-Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
+Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
 Reviewed-by: Denis V. Lunev <den@openvz.org>
 Message-ID: <20241212104212.513947-2-gerben@altlinux.org>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- hw/block/virtio-blk.c | 3 ++-
+ block/parallels.c | 4 ++++
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+)
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
+diff --git a/block/parallels.c b/block/parallels.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
+--- a/block/parallels.c
-+++ b/hw/block/virtio-blk.c
++++ b/block/parallels.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
+@@ -XXX,XX +XXX,XX @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
-             sizeof(struct virtio_blk_zone_report) +
+         error_setg(errp, "Catalog too large");
-             sizeof(struct virtio_blk_zone_descriptor)) {
+         return -EFBIG;
          virtio_error(vdev, "in buffer too small for zone report");
 -        return;
 +        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
 +        goto out;
      }
++    if (le64_to_cpu(ph.ext_off) >= (INT64_MAX >> BDRV_SECTOR_BITS)) {
-     /* start byte offset of the zone report */
++        error_setg(errp, "Invalid image: Too big offset");
 +        return -EFBIG;
 +    }
      size = bat_entry_off(s->bat_size);
      s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file->bs));
 --
-.44.0
+.48.1

From: Zheyu Ma <zheyuma97@gmail.com>

This modification ensures that in scenarios where the buffer size is
insufficient for a zone report, the function will now properly set an
error status and proceed to a cleanup label, instead of merely
returning.

The following ASAN log reveals it:

==1767400==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 312 byte(s) in 1 object(s) allocated from:
    #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
    #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
    #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
    #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
    #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
    #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_zone_report(VirtIOBlockReq *req,
             sizeof(struct virtio_blk_zone_report) +
             sizeof(struct virtio_blk_zone_descriptor)) {
         virtio_error(vdev, "in buffer too small for zone report");
-        return;
+        err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
+        goto out;
     }
 
     /* start byte offset of the zone report */
-- 
2.44.0

From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

When ph.ext_off has a sufficiently large value, the operation
le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in
parallels_read_format_extension() can cause an overflow in int64_t.
This overflow triggers the assert(ext_off > 0)
check in block/parallels-ext.c: parallels_read_format_extension(),
leading to a crash.

This commit adds a check to prevent overflow when shifting ph.ext_off
by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range.

Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru>
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Message-ID: <20241212104212.513947-2-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/parallels.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/block/parallels.c b/block/parallels.c
index XXXXXXX..XXXXXXX 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -XXX,XX +XXX,XX @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
         error_setg(errp, "Catalog too large");
         return -EFBIG;
     }
+    if (le64_to_cpu(ph.ext_off) >= (INT64_MAX >> BDRV_SECTOR_BITS)) {
+        error_setg(errp, "Invalid image: Too big offset");
+        return -EFBIG;
+    }
 
     size = bat_entry_off(s->bat_size);
     s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file->bs));
-- 
2.48.1