[PULL 0/9] parallels: fix reachable assertion and related bounds-checking gaps

Denis V. Lunev posted 9 patches 2 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260728104221.3981592-1-den@openvz.org
Maintainers: Stefan Hajnoczi <stefanha@redhat.com>, "Denis V. Lunev" <den@openvz.org>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>
There is a newer version of this series
MAINTAINERS                                   |   2 +-
block/parallels-ext.c                         |  52 +++++----
block/parallels.c                             |  74 ++++++++++---
tests/qemu-iotests/212                        |   8 +-
tests/qemu-iotests/212.out                    |  10 +-
tests/qemu-iotests/tests/parallels-checks     | 102 ++++++++++++++++++
tests/qemu-iotests/tests/parallels-checks.out |  59 ++++++++++
7 files changed, 270 insertions(+), 37 deletions(-)
[PULL 0/9] parallels: fix reachable assertion and related bounds-checking gaps
Posted by Denis V. Lunev 2 months ago
The following changes since commit 6333226c2abb72f31648c251624c56e70993d625:

  Merge tag 'pull-9p-20260725' of https://github.com/cschoenebeck/qemu into staging (2026-07-26 08:30:07 -0400)

are available in the Git repository at:

  https://gitlab.com/dlunev/qemu.git tags/pull-parallels-2026-07-22

for you to fetch changes up to 2a1c31578eb96f829f3234fe9da1abecbb11aa1e:

  MAINTAINERS: update parallels tree location (2026-07-27 14:42:24 +0200)

----------------------------------------------------------------
Parallels block driver patches

- fix a reachable assert()/process abort on a crafted image with an
  inconsistent BAT vs. advertised disk size (GitLab #3804)
- fix related integer overflows capping the format's usable catalog
  size below its documented maximum
- reject BAT entries pointing outside the data area in either
  direction
- harden the dirty-bitmap extension loader against a reachable
  abort and an unsafe allocator

This is my first pull request signed with this key:

  RSA rsa4096/0BAEAA87D3020ADC1150E51F5E0771B6CB666CAB
  Denis V. Lunev <den@openvz.org>

Public key: https://keys.openpgp.org/vks/v1/by-fingerprint/0BAEAA87D3020ADC1150E51F5E0771B6CB666CAB

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Thomas Huth <thuth@redhat.com>
CC: Stefan Hajnoczi <stefanha@redhat.com>

----------------------------------------------------------------
Denis V. Lunev (9):
  parallels: fix integer overflow in header size calculation
  parallels: read header/BAT table in bounded chunks
  parallels: fix bat_entries overflow in image creation
  parallels: reject BAT entries pointing outside backed storage
  parallels: validate bitmap L1 table size before allocating it
  parallels: skip loading a genuinely empty bitmap L1 table
  parallels: avoid fatal abort on large bitmap L1 table
  parallels: validate BAT capacity against advertised disk size
  MAINTAINERS: update parallels tree location

 MAINTAINERS                                   |   2 +-
 block/parallels-ext.c                         |  52 +++++----
 block/parallels.c                             |  74 ++++++++++---
 tests/qemu-iotests/212                        |   8 +-
 tests/qemu-iotests/212.out                    |  10 +-
 tests/qemu-iotests/tests/parallels-checks     | 102 ++++++++++++++++++
 tests/qemu-iotests/tests/parallels-checks.out |  59 ++++++++++
 7 files changed, 270 insertions(+), 37 deletions(-)

-- 
2.53.0
Re: [PULL 0/9] parallels: fix reachable assertion and related bounds-checking gaps
Posted by Stefan Hajnoczi 2 months ago
The qemu-iotests parallels-checks output has a mismatch:
https://gitlab.com/qemu-project/qemu/-/jobs/15576051278#L143

53/56 block-parallels-optional+block-thorough -
qemu:io-parallels-parallels-checks ERROR 9.82s exit status 1
>>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 RUST_BACKTRACE=1 PYTHON=/builds/qemu-project/qemu/build/pyvenv/bin/python3 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 MALLOC_PERTURB_=221 MESON_TEST_ITERATION=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 LD_LIBRARY_PATH=/builds/qemu-project/qemu/build/subprojects/libvfio-user/lib /builds/qemu-project/qemu/build/pyvenv/bin/python3 /builds/qemu-project/qemu/build/../tests/qemu-iotests/check -tap -parallels parallels-checks --source-dir /builds/qemu-project/qemu/tests/qemu-iotests --build-dir /builds/qemu-project/qemu/build/tests/qemu-iotests
――――――――――――――――――――――――――――――――――――― ✀ ―――――――――――――――――――――――――――――――――――――
stderr:
--- /builds/qemu-project/qemu/tests/qemu-iotests/tests/parallels-checks.out
+++ /builds/qemu-project/qemu/build/scratch/parallels-file-parallels-checks/parallels-checks.out.bad
@@ -143,6 +143,8 @@
protocol type: file
file length: 2 GiB (2147483648 bytes)
disk size: 1 MiB
+ Format specific information:
+ extent size hint: 1048576
== an unallocated cluster still reads as zeroes ==
read 1048576/1048576 bytes at offset 0
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
(test program exited with status code 1)

On Tue, Jul 28, 2026 at 6:43 AM Denis V. Lunev <den@openvz.org> wrote:
>
> The following changes since commit 6333226c2abb72f31648c251624c56e70993d625:
>
>   Merge tag 'pull-9p-20260725' of https://github.com/cschoenebeck/qemu into staging (2026-07-26 08:30:07 -0400)
>
> are available in the Git repository at:
>
>   https://gitlab.com/dlunev/qemu.git tags/pull-parallels-2026-07-22
>
> for you to fetch changes up to 2a1c31578eb96f829f3234fe9da1abecbb11aa1e:
>
>   MAINTAINERS: update parallels tree location (2026-07-27 14:42:24 +0200)
>
> ----------------------------------------------------------------
> Parallels block driver patches
>
> - fix a reachable assert()/process abort on a crafted image with an
>   inconsistent BAT vs. advertised disk size (GitLab #3804)
> - fix related integer overflows capping the format's usable catalog
>   size below its documented maximum
> - reject BAT entries pointing outside the data area in either
>   direction
> - harden the dirty-bitmap extension loader against a reachable
>   abort and an unsafe allocator
>
> This is my first pull request signed with this key:
>
>   RSA rsa4096/0BAEAA87D3020ADC1150E51F5E0771B6CB666CAB
>   Denis V. Lunev <den@openvz.org>
>
> Public key: https://keys.openpgp.org/vks/v1/by-fingerprint/0BAEAA87D3020ADC1150E51F5E0771B6CB666CAB
>
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> CC: Thomas Huth <thuth@redhat.com>
> CC: Stefan Hajnoczi <stefanha@redhat.com>
>
> ----------------------------------------------------------------
> Denis V. Lunev (9):
>   parallels: fix integer overflow in header size calculation
>   parallels: read header/BAT table in bounded chunks
>   parallels: fix bat_entries overflow in image creation
>   parallels: reject BAT entries pointing outside backed storage
>   parallels: validate bitmap L1 table size before allocating it
>   parallels: skip loading a genuinely empty bitmap L1 table
>   parallels: avoid fatal abort on large bitmap L1 table
>   parallels: validate BAT capacity against advertised disk size
>   MAINTAINERS: update parallels tree location
>
>  MAINTAINERS                                   |   2 +-
>  block/parallels-ext.c                         |  52 +++++----
>  block/parallels.c                             |  74 ++++++++++---
>  tests/qemu-iotests/212                        |   8 +-
>  tests/qemu-iotests/212.out                    |  10 +-
>  tests/qemu-iotests/tests/parallels-checks     | 102 ++++++++++++++++++
>  tests/qemu-iotests/tests/parallels-checks.out |  59 ++++++++++
>  7 files changed, 270 insertions(+), 37 deletions(-)
>
> --
> 2.53.0
>
>
Re: [PULL 0/9] parallels: fix reachable assertion and related bounds-checking gaps
Posted by Denis V. Lunev 2 months ago
On 7/28/26 16:01, Stefan Hajnoczi wrote:
> The qemu-iotests parallels-checks output has a mismatch:
> https://gitlab.com/qemu-project/qemu/-/jobs/15576051278#L143
>
> 53/56 block-parallels-optional+block-thorough -
> qemu:io-parallels-parallels-checks ERROR 9.82s exit status 1
>>>> ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 RUST_BACKTRACE=1 PYTHON=/builds/qemu-project/qemu/build/pyvenv/bin/python3 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 MALLOC_PERTURB_=221 MESON_TEST_ITERATION=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 LD_LIBRARY_PATH=/builds/qemu-project/qemu/build/subprojects/libvfio-user/lib /builds/qemu-project/qemu/build/pyvenv/bin/python3 /builds/qemu-project/qemu/build/../tests/qemu-iotests/check -tap -parallels parallels-checks --source-dir /builds/qemu-project/qemu/tests/qemu-iotests --build-dir /builds/qemu-project/qemu/build/tests/qemu-iotests
> ――――――――――――――――――――――――――――――――――――― ✀ ―――――――――――――――――――――――――――――――――――――
> stderr:
> --- /builds/qemu-project/qemu/tests/qemu-iotests/tests/parallels-checks.out
> +++ /builds/qemu-project/qemu/build/scratch/parallels-file-parallels-checks/parallels-checks.out.bad
> @@ -143,6 +143,8 @@
> protocol type: file
> file length: 2 GiB (2147483648 bytes)
> disk size: 1 MiB
> + Format specific information:
> + extent size hint: 1048576
> == an unallocated cluster still reads as zeroes ==
> read 1048576/1048576 bytes at offset 0
> 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
> (test program exited with status code 1)

Interesting :-)

The difference comes from the underlying filesystem. I use ext4 locally and
runner seems uses XFS.

dev007 ~ # qemu-img info hint.parallels
image: hint.parallels
file format: parallels
virtual size: 4 MiB (4194304 bytes)
disk size: 1 MiB
Child node '/file':
    filename: hint.parallels
    protocol type: file
    file length: 1 MiB (1048576 bytes)
    disk size: 1 MiB
    Format specific information: <----- XFS specific info
        extent size hint: 1048576
dev007 ~ # 

I will fix and re-spin.

Den