1
The following changes since commit 871af84dd599fab68c8ed414d9ecbdb2bcfc5801:
1
The following changes since commit d88d5a3806d78dcfca648c62dae9d88d3e803bd2:
2
2
3
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2025-01-29 09:51:03 -0500)
3
Merge remote-tracking branch 'remotes/philmd-gitlab/tags/renesas-hw-20200622' into staging (2020-06-23 13:55:52 +0100)
4
4
5
are available in the Git repository at:
5
are available in the Git repository at:
6
6
7
https://gitlab.com/stefanha/qemu.git tags/block-pull-request
7
https://github.com/XanClic/qemu.git tags/pull-block-2020-06-24
8
8
9
for you to fetch changes up to 58607752d173438994d28dea7e2c2587726663e6:
9
for you to fetch changes up to 24b861c0386a17ea31eb824310c21118fb7be883:
10
10
11
parallels: fix ext_off assertion failure due to overflow (2025-01-30 15:22:28 -0500)
11
iotests: don't test qcow2.py inside 291 (2020-06-24 10:00:04 +0200)
12
12
13
----------------------------------------------------------------
13
----------------------------------------------------------------
14
Pull request
14
Block patches:
15
- Two iotest fixes
15
16
16
----------------------------------------------------------------
17
----------------------------------------------------------------
18
This is v2, where I dropped Maxim’s LUKS keyslot amendment series and my
19
iotest patches, because both caused iotest failures on some test
20
machines.
21
----------------------------------------------------------------
22
Philippe Mathieu-Daudé (1):
23
iotests: Fix 051 output after qdev_init_nofail() removal
17
24
18
Denis Rastyogin (1):
25
Vladimir Sementsov-Ogievskiy (1):
19
parallels: fix ext_off assertion failure due to overflow
26
iotests: don't test qcow2.py inside 291
20
27
21
block/parallels.c | 4 ++++
28
tests/qemu-iotests/051.pc.out | 4 ++--
22
1 file changed, 4 insertions(+)
29
tests/qemu-iotests/291 | 4 ----
30
tests/qemu-iotests/291.out | 33 ---------------------------------
31
3 files changed, 2 insertions(+), 39 deletions(-)
23
32
24
--
33
--
25
2.48.1
34
2.26.2
35
36
diff view generated by jsdifflib
New patch
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
2
3
Commit 96927c744 replaced qdev_init_nofail() call by
4
isa_realize_and_unref() which has a different error
5
message. Update the test output accordingly.
6
7
Gitlab CI error after merging b77b5b3dc7:
8
https://gitlab.com/qemu-project/qemu/-/jobs/597414772#L4375
9
10
Reported-by: Thomas Huth <thuth@redhat.com>
11
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
12
Message-Id: <20200616154949.6586-1-philmd@redhat.com>
13
Reviewed-by: Thomas Huth <thuth@redhat.com>
14
Signed-off-by: Max Reitz <mreitz@redhat.com>
15
---
16
tests/qemu-iotests/051.pc.out | 4 ++--
17
1 file changed, 2 insertions(+), 2 deletions(-)
18
19
diff --git a/tests/qemu-iotests/051.pc.out b/tests/qemu-iotests/051.pc.out
20
index XXXXXXX..XXXXXXX 100644
21
--- a/tests/qemu-iotests/051.pc.out
22
+++ b/tests/qemu-iotests/051.pc.out
23
@@ -XXX,XX +XXX,XX @@ QEMU X.Y.Z monitor - type 'help' for more information
24
25
Testing: -drive if=ide
26
QEMU X.Y.Z monitor - type 'help' for more information
27
-(qemu) QEMU_PROG: Initialization of device ide-hd failed: Device needs media, but drive is empty
28
+(qemu) QEMU_PROG: Device needs media, but drive is empty
29
30
Testing: -drive if=virtio
31
QEMU X.Y.Z monitor - type 'help' for more information
32
@@ -XXX,XX +XXX,XX @@ QEMU X.Y.Z monitor - type 'help' for more information
33
34
Testing: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on
35
QEMU X.Y.Z monitor - type 'help' for more information
36
-(qemu) QEMU_PROG: Initialization of device ide-hd failed: Block node is read-only
37
+(qemu) QEMU_PROG: Block node is read-only
38
39
Testing: -drive file=TEST_DIR/t.qcow2,if=virtio,readonly=on
40
QEMU X.Y.Z monitor - type 'help' for more information
41
--
42
2.26.2
43
44
diff view generated by jsdifflib
1
From: Denis Rastyogin <gerben@altlinux.org>
1
From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2
2
3
This error was discovered by fuzzing qemu-img.
3
820c6bee534ec3b added testing of qcow2.py into 291, and it breaks 291
4
with external data file. Actually, 291 is bad place for qcow2.py
5
testing, better add a separate test.
4
6
5
When ph.ext_off has a sufficiently large value, the operation
7
For now, drop qcow2.py testing from 291 to fix the regression.
6
le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in
7
parallels_read_format_extension() can cause an overflow in int64_t.
8
This overflow triggers the assert(ext_off > 0)
9
check in block/parallels-ext.c: parallels_read_format_extension(),
10
leading to a crash.
11
8
12
This commit adds a check to prevent overflow when shifting ph.ext_off
9
Fixes: 820c6bee534ec3b
13
by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range.
10
Reported-by: Max Reitz <mreitz@redhat.com>
11
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
12
Message-Id: <20200618154052.8629-1-vsementsov@virtuozzo.com>
13
Reviewed-by: Eric Blake <eblake@redhat.com>
14
Signed-off-by: Max Reitz <mreitz@redhat.com>
15
---
16
tests/qemu-iotests/291 | 4 ----
17
tests/qemu-iotests/291.out | 33 ---------------------------------
18
2 files changed, 37 deletions(-)
14
19
15
Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru>
20
diff --git a/tests/qemu-iotests/291 b/tests/qemu-iotests/291
16
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
21
index XXXXXXX..XXXXXXX 100755
17
Reviewed-by: Denis V. Lunev <den@openvz.org>
22
--- a/tests/qemu-iotests/291
18
Message-ID: <20241212104212.513947-2-gerben@altlinux.org>
23
+++ b/tests/qemu-iotests/291
19
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
24
@@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'w 1M 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io
20
---
25
$QEMU_IMG bitmap --disable -f $IMGFMT "$TEST_IMG" b1
21
block/parallels.c | 4 ++++
26
$QEMU_IMG bitmap --enable -f $IMGFMT "$TEST_IMG" b2
22
1 file changed, 4 insertions(+)
27
$QEMU_IO -c 'w 2M 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io
28
-echo "Check resulting qcow2 header extensions:"
29
-$PYTHON qcow2.py "$TEST_IMG" dump-header-exts
30
31
echo
32
echo "=== Bitmap preservation not possible to non-qcow2 ==="
33
@@ -XXX,XX +XXX,XX @@ $QEMU_IMG bitmap --merge tmp -f $IMGFMT "$TEST_IMG" b0
34
$QEMU_IMG bitmap --remove --image-opts \
35
driver=$IMGFMT,file.driver=file,file.filename="$TEST_IMG" tmp
36
_img_info --format-specific
37
-echo "Check resulting qcow2 header extensions:"
38
-$PYTHON qcow2.py "$TEST_IMG" dump-header-exts
39
40
echo
41
echo "=== Check bitmap contents ==="
42
diff --git a/tests/qemu-iotests/291.out b/tests/qemu-iotests/291.out
43
index XXXXXXX..XXXXXXX 100644
44
--- a/tests/qemu-iotests/291.out
45
+++ b/tests/qemu-iotests/291.out
46
@@ -XXX,XX +XXX,XX @@ wrote 1048576/1048576 bytes at offset 1048576
47
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
48
wrote 1048576/1048576 bytes at offset 2097152
49
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
50
-Check resulting qcow2 header extensions:
51
-Header extension:
52
-magic 0xe2792aca (Backing format)
53
-length 5
54
-data 'qcow2'
55
-
56
-Header extension:
57
-magic 0x6803f857 (Feature table)
58
-length 336
59
-data <binary>
60
-
61
-Header extension:
62
-magic 0x23852875 (Bitmaps)
63
-length 24
64
-nb_bitmaps 2
65
-reserved32 0
66
-bitmap_directory_size 0x40
67
-bitmap_directory_offset 0x510000
68
-
69
70
=== Bitmap preservation not possible to non-qcow2 ===
71
72
@@ -XXX,XX +XXX,XX @@ Format specific information:
73
granularity: 65536
74
refcount bits: 16
75
corrupt: false
76
-Check resulting qcow2 header extensions:
77
-Header extension:
78
-magic 0x6803f857 (Feature table)
79
-length 336
80
-data <binary>
81
-
82
-Header extension:
83
-magic 0x23852875 (Bitmaps)
84
-length 24
85
-nb_bitmaps 3
86
-reserved32 0
87
-bitmap_directory_size 0x60
88
-bitmap_directory_offset 0x520000
89
-
90
91
=== Check bitmap contents ===
92
93
--
94
2.26.2
23
95
24
diff --git a/block/parallels.c b/block/parallels.c
96
25
index XXXXXXX..XXXXXXX 100644
26
--- a/block/parallels.c
27
+++ b/block/parallels.c
28
@@ -XXX,XX +XXX,XX @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
29
error_setg(errp, "Catalog too large");
30
return -EFBIG;
31
}
32
+ if (le64_to_cpu(ph.ext_off) >= (INT64_MAX >> BDRV_SECTOR_BITS)) {
33
+ error_setg(errp, "Invalid image: Too big offset");
34
+ return -EFBIG;
35
+ }
36
37
size = bat_entry_off(s->bat_size);
38
s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file->bs));
39
--
40
2.48.1
diff view generated by jsdifflib