1 | The following changes since commit 871af84dd599fab68c8ed414d9ecbdb2bcfc5801: | 1 | The following changes since commit d88d5a3806d78dcfca648c62dae9d88d3e803bd2: |
---|---|---|---|
2 | 2 | ||
3 | Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2025-01-29 09:51:03 -0500) | 3 | Merge remote-tracking branch 'remotes/philmd-gitlab/tags/renesas-hw-20200622' into staging (2020-06-23 13:55:52 +0100) |
4 | 4 | ||
5 | are available in the Git repository at: | 5 | are available in the Git repository at: |
6 | 6 | ||
7 | https://gitlab.com/stefanha/qemu.git tags/block-pull-request | 7 | https://github.com/XanClic/qemu.git tags/pull-block-2020-06-24 |
8 | 8 | ||
9 | for you to fetch changes up to 58607752d173438994d28dea7e2c2587726663e6: | 9 | for you to fetch changes up to 24b861c0386a17ea31eb824310c21118fb7be883: |
10 | 10 | ||
11 | parallels: fix ext_off assertion failure due to overflow (2025-01-30 15:22:28 -0500) | 11 | iotests: don't test qcow2.py inside 291 (2020-06-24 10:00:04 +0200) |
12 | 12 | ||
13 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
14 | Pull request | 14 | Block patches: |
15 | - Two iotest fixes | ||
15 | 16 | ||
16 | ---------------------------------------------------------------- | 17 | ---------------------------------------------------------------- |
18 | This is v2, where I dropped Maxim’s LUKS keyslot amendment series and my | ||
19 | iotest patches, because both caused iotest failures on some test | ||
20 | machines. | ||
21 | ---------------------------------------------------------------- | ||
22 | Philippe Mathieu-Daudé (1): | ||
23 | iotests: Fix 051 output after qdev_init_nofail() removal | ||
17 | 24 | ||
18 | Denis Rastyogin (1): | 25 | Vladimir Sementsov-Ogievskiy (1): |
19 | parallels: fix ext_off assertion failure due to overflow | 26 | iotests: don't test qcow2.py inside 291 |
20 | 27 | ||
21 | block/parallels.c | 4 ++++ | 28 | tests/qemu-iotests/051.pc.out | 4 ++-- |
22 | 1 file changed, 4 insertions(+) | 29 | tests/qemu-iotests/291 | 4 ---- |
30 | tests/qemu-iotests/291.out | 33 --------------------------------- | ||
31 | 3 files changed, 2 insertions(+), 39 deletions(-) | ||
23 | 32 | ||
24 | -- | 33 | -- |
25 | 2.48.1 | 34 | 2.26.2 |
35 | |||
36 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
1 | 2 | ||
3 | Commit 96927c744 replaced qdev_init_nofail() call by | ||
4 | isa_realize_and_unref() which has a different error | ||
5 | message. Update the test output accordingly. | ||
6 | |||
7 | Gitlab CI error after merging b77b5b3dc7: | ||
8 | https://gitlab.com/qemu-project/qemu/-/jobs/597414772#L4375 | ||
9 | |||
10 | Reported-by: Thomas Huth <thuth@redhat.com> | ||
11 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
12 | Message-Id: <20200616154949.6586-1-philmd@redhat.com> | ||
13 | Reviewed-by: Thomas Huth <thuth@redhat.com> | ||
14 | Signed-off-by: Max Reitz <mreitz@redhat.com> | ||
15 | --- | ||
16 | tests/qemu-iotests/051.pc.out | 4 ++-- | ||
17 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
18 | |||
19 | diff --git a/tests/qemu-iotests/051.pc.out b/tests/qemu-iotests/051.pc.out | ||
20 | index XXXXXXX..XXXXXXX 100644 | ||
21 | --- a/tests/qemu-iotests/051.pc.out | ||
22 | +++ b/tests/qemu-iotests/051.pc.out | ||
23 | @@ -XXX,XX +XXX,XX @@ QEMU X.Y.Z monitor - type 'help' for more information | ||
24 | |||
25 | Testing: -drive if=ide | ||
26 | QEMU X.Y.Z monitor - type 'help' for more information | ||
27 | -(qemu) QEMU_PROG: Initialization of device ide-hd failed: Device needs media, but drive is empty | ||
28 | +(qemu) QEMU_PROG: Device needs media, but drive is empty | ||
29 | |||
30 | Testing: -drive if=virtio | ||
31 | QEMU X.Y.Z monitor - type 'help' for more information | ||
32 | @@ -XXX,XX +XXX,XX @@ QEMU X.Y.Z monitor - type 'help' for more information | ||
33 | |||
34 | Testing: -drive file=TEST_DIR/t.qcow2,if=ide,readonly=on | ||
35 | QEMU X.Y.Z monitor - type 'help' for more information | ||
36 | -(qemu) QEMU_PROG: Initialization of device ide-hd failed: Block node is read-only | ||
37 | +(qemu) QEMU_PROG: Block node is read-only | ||
38 | |||
39 | Testing: -drive file=TEST_DIR/t.qcow2,if=virtio,readonly=on | ||
40 | QEMU X.Y.Z monitor - type 'help' for more information | ||
41 | -- | ||
42 | 2.26.2 | ||
43 | |||
44 | diff view generated by jsdifflib |
1 | From: Denis Rastyogin <gerben@altlinux.org> | 1 | From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> |
---|---|---|---|
2 | 2 | ||
3 | This error was discovered by fuzzing qemu-img. | 3 | 820c6bee534ec3b added testing of qcow2.py into 291, and it breaks 291 |
4 | with external data file. Actually, 291 is bad place for qcow2.py | ||
5 | testing, better add a separate test. | ||
4 | 6 | ||
5 | When ph.ext_off has a sufficiently large value, the operation | 7 | For now, drop qcow2.py testing from 291 to fix the regression. |
6 | le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in | ||
7 | parallels_read_format_extension() can cause an overflow in int64_t. | ||
8 | This overflow triggers the assert(ext_off > 0) | ||
9 | check in block/parallels-ext.c: parallels_read_format_extension(), | ||
10 | leading to a crash. | ||
11 | 8 | ||
12 | This commit adds a check to prevent overflow when shifting ph.ext_off | 9 | Fixes: 820c6bee534ec3b |
13 | by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range. | 10 | Reported-by: Max Reitz <mreitz@redhat.com> |
11 | Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | ||
12 | Message-Id: <20200618154052.8629-1-vsementsov@virtuozzo.com> | ||
13 | Reviewed-by: Eric Blake <eblake@redhat.com> | ||
14 | Signed-off-by: Max Reitz <mreitz@redhat.com> | ||
15 | --- | ||
16 | tests/qemu-iotests/291 | 4 ---- | ||
17 | tests/qemu-iotests/291.out | 33 --------------------------------- | ||
18 | 2 files changed, 37 deletions(-) | ||
14 | 19 | ||
15 | Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru> | 20 | diff --git a/tests/qemu-iotests/291 b/tests/qemu-iotests/291 |
16 | Signed-off-by: Denis Rastyogin <gerben@altlinux.org> | 21 | index XXXXXXX..XXXXXXX 100755 |
17 | Reviewed-by: Denis V. Lunev <den@openvz.org> | 22 | --- a/tests/qemu-iotests/291 |
18 | Message-ID: <20241212104212.513947-2-gerben@altlinux.org> | 23 | +++ b/tests/qemu-iotests/291 |
19 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 24 | @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'w 1M 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io |
20 | --- | 25 | $QEMU_IMG bitmap --disable -f $IMGFMT "$TEST_IMG" b1 |
21 | block/parallels.c | 4 ++++ | 26 | $QEMU_IMG bitmap --enable -f $IMGFMT "$TEST_IMG" b2 |
22 | 1 file changed, 4 insertions(+) | 27 | $QEMU_IO -c 'w 2M 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io |
28 | -echo "Check resulting qcow2 header extensions:" | ||
29 | -$PYTHON qcow2.py "$TEST_IMG" dump-header-exts | ||
30 | |||
31 | echo | ||
32 | echo "=== Bitmap preservation not possible to non-qcow2 ===" | ||
33 | @@ -XXX,XX +XXX,XX @@ $QEMU_IMG bitmap --merge tmp -f $IMGFMT "$TEST_IMG" b0 | ||
34 | $QEMU_IMG bitmap --remove --image-opts \ | ||
35 | driver=$IMGFMT,file.driver=file,file.filename="$TEST_IMG" tmp | ||
36 | _img_info --format-specific | ||
37 | -echo "Check resulting qcow2 header extensions:" | ||
38 | -$PYTHON qcow2.py "$TEST_IMG" dump-header-exts | ||
39 | |||
40 | echo | ||
41 | echo "=== Check bitmap contents ===" | ||
42 | diff --git a/tests/qemu-iotests/291.out b/tests/qemu-iotests/291.out | ||
43 | index XXXXXXX..XXXXXXX 100644 | ||
44 | --- a/tests/qemu-iotests/291.out | ||
45 | +++ b/tests/qemu-iotests/291.out | ||
46 | @@ -XXX,XX +XXX,XX @@ wrote 1048576/1048576 bytes at offset 1048576 | ||
47 | 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
48 | wrote 1048576/1048576 bytes at offset 2097152 | ||
49 | 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) | ||
50 | -Check resulting qcow2 header extensions: | ||
51 | -Header extension: | ||
52 | -magic 0xe2792aca (Backing format) | ||
53 | -length 5 | ||
54 | -data 'qcow2' | ||
55 | - | ||
56 | -Header extension: | ||
57 | -magic 0x6803f857 (Feature table) | ||
58 | -length 336 | ||
59 | -data <binary> | ||
60 | - | ||
61 | -Header extension: | ||
62 | -magic 0x23852875 (Bitmaps) | ||
63 | -length 24 | ||
64 | -nb_bitmaps 2 | ||
65 | -reserved32 0 | ||
66 | -bitmap_directory_size 0x40 | ||
67 | -bitmap_directory_offset 0x510000 | ||
68 | - | ||
69 | |||
70 | === Bitmap preservation not possible to non-qcow2 === | ||
71 | |||
72 | @@ -XXX,XX +XXX,XX @@ Format specific information: | ||
73 | granularity: 65536 | ||
74 | refcount bits: 16 | ||
75 | corrupt: false | ||
76 | -Check resulting qcow2 header extensions: | ||
77 | -Header extension: | ||
78 | -magic 0x6803f857 (Feature table) | ||
79 | -length 336 | ||
80 | -data <binary> | ||
81 | - | ||
82 | -Header extension: | ||
83 | -magic 0x23852875 (Bitmaps) | ||
84 | -length 24 | ||
85 | -nb_bitmaps 3 | ||
86 | -reserved32 0 | ||
87 | -bitmap_directory_size 0x60 | ||
88 | -bitmap_directory_offset 0x520000 | ||
89 | - | ||
90 | |||
91 | === Check bitmap contents === | ||
92 | |||
93 | -- | ||
94 | 2.26.2 | ||
23 | 95 | ||
24 | diff --git a/block/parallels.c b/block/parallels.c | 96 | |
25 | index XXXXXXX..XXXXXXX 100644 | ||
26 | --- a/block/parallels.c | ||
27 | +++ b/block/parallels.c | ||
28 | @@ -XXX,XX +XXX,XX @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, | ||
29 | error_setg(errp, "Catalog too large"); | ||
30 | return -EFBIG; | ||
31 | } | ||
32 | + if (le64_to_cpu(ph.ext_off) >= (INT64_MAX >> BDRV_SECTOR_BITS)) { | ||
33 | + error_setg(errp, "Invalid image: Too big offset"); | ||
34 | + return -EFBIG; | ||
35 | + } | ||
36 | |||
37 | size = bat_entry_off(s->bat_size); | ||
38 | s->header_size = ROUND_UP(size, bdrv_opt_mem_align(bs->file->bs)); | ||
39 | -- | ||
40 | 2.48.1 | diff view generated by jsdifflib |