From nobody Mon May 6 21:16:44 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1572593956; cv=none; d=zoho.com; s=zohoarc; b=APYxgAR4CJqyFdpwIaHWHljR53gOR4CNOWV1csHo0+CMxEvW9PlK53h4Ln5sFKhu9Ox5CQy2rGRG/CFhpxOQPRqAzbEAYGlNaJyYOyWY/eMP20Rg2XzD5PrxMZL/MNswg8nB7hSs8htBsJQLM3nfgThdoV7BsMo+aITKQkmrMSc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1572593956; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=mPwGzNG+H9fdG/kIBtLU/g50NYNZ12aDIPBXPmBfWzw=; b=SdxYSyzdYdINEbUyRS/9JEE8eERg1Xq/GYEdVT19+Tl4YfTvudE/BWcpZMWZoeY3OnOdwGbiFoiWWuU5wuyjsbB8VgeDGcweYwRTkBN0j3IA/5nveVc3GloPMKIXk5cSjR23vDfe2iNyb7UNKn9b8O2zudwkK4QVWovmSqGTNPs= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1572593956197248.1178844165745; Fri, 1 Nov 2019 00:39:16 -0700 (PDT) Received: from localhost ([::1]:57030 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iQRWb-0002F0-Av for importer@patchew.org; Fri, 01 Nov 2019 03:39:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:44365) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iQRVu-0001i6-Jh for qemu-devel@nongnu.org; Fri, 01 Nov 2019 03:38:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iQRVt-0000yU-Bz for qemu-devel@nongnu.org; Fri, 01 Nov 2019 03:38:30 -0400 Received: from smtp.h3c.com ([60.191.123.50]:39081 helo=h3cspam02-ex.h3c.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1iQRVo-0000kf-CA; Fri, 01 Nov 2019 03:38:25 -0400 Received: from DAG2EX06-IDC.srv.huawei-3com.com ([10.8.0.69]) by h3cspam02-ex.h3c.com with ESMTPS id xA17bZqc031543 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 1 Nov 2019 15:37:35 +0800 (GMT-8) (envelope-from tu.guoyi@h3c.com) Received: from DAG2EX03-BASE.srv.huawei-3com.com (10.8.0.66) by DAG2EX06-IDC.srv.huawei-3com.com (10.8.0.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Fri, 1 Nov 2019 15:37:37 +0800 Received: from DAG2EX03-BASE.srv.huawei-3com.com ([fe80::5d18:e01c:bbbd:c074]) by DAG2EX03-BASE.srv.huawei-3com.com ([fe80::5d18:e01c:bbbd:c074%6]) with mapi id 15.01.1713.004; Fri, 1 Nov 2019 15:37:37 +0800 From: Tuguoyi To: Vladimir Sementsov-Ogievskiy , "kwolf@redhat.com" , "mreitz@redhat.com" , "qemu-block@nongnu.org" Subject: [PATCH v4] qcow2-bitmap: Fix uint64_t left-shift overflow Thread-Topic: [PATCH v4] qcow2-bitmap: Fix uint64_t left-shift overflow Thread-Index: AdWQhrb0bffMwMc6ShSREntjykPuIg== Date: Fri, 1 Nov 2019 07:37:35 +0000 Message-ID: <4ba40cd1e7ee4a708b40899952e49f22@h3c.com> Accept-Language: en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.125.108.112] x-sender-location: DAG2 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-DNSRBL: X-MAIL: h3cspam02-ex.h3c.com xA17bZqc031543 X-detected-operating-system: by eggs.gnu.org: FreeBSD 9.x [fuzzy] X-Received-From: 60.191.123.50 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Chengchiwen , "qemu-devel@nongnu.org" , "qemu-stable@nongnu.org" , Wangyongqing , Changlimin , Gaoliang , Wangyong Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" There are two issues in In check_constraints_on_bitmap(), 1) The sanity check on the granularity will cause uint64_t integer left-shift overflow when cluster_size is 2M and the granularity is BIGGER than 32K. 2) The way to calculate image size that the maximum bitmap supported can map to is a bit incorrect. This patch fix it by add a helper function to calculate the number of bytes needed by a normal bitmap in image and compare it to the maximum bitmap bytes supported by qemu. Fixes: 5f72826e7fc62167cf3a Signed-off-by: Guoyi Tu Reviewed-by: Vladimir Sementsov-Ogievskiy --- block/qcow2-bitmap.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c index 98294a7..ef9ef62 100644 --- a/block/qcow2-bitmap.c +++ b/block/qcow2-bitmap.c @@ -142,6 +142,13 @@ static int check_table_entry(uint64_t entry, int clust= er_size) return 0; } =20 +static int64_t get_bitmap_bytes_needed(int64_t len, uint32_t granularity) +{ + int64_t num_bits =3D DIV_ROUND_UP(len, granularity); + + return DIV_ROUND_UP(num_bits, 8); +} + static int check_constraints_on_bitmap(BlockDriverState *bs, const char *name, uint32_t granularity, @@ -150,6 +157,7 @@ static int check_constraints_on_bitmap(BlockDriverState= *bs, BDRVQcow2State *s =3D bs->opaque; int granularity_bits =3D ctz32(granularity); int64_t len =3D bdrv_getlength(bs); + int64_t bitmap_bytes; =20 assert(granularity > 0); assert((granularity & (granularity - 1)) =3D=3D 0); @@ -171,9 +179,9 @@ static int check_constraints_on_bitmap(BlockDriverState= *bs, return -EINVAL; } =20 - if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) || - (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size << - granularity_bits)) + bitmap_bytes =3D get_bitmap_bytes_needed(len, granularity); + if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) || + (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size)) { error_setg(errp, "Too much space will be occupied by the bitmap. " "Use larger granularity"); --=20 2.7.4 [Patch v3]: https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg07989.= html [Patch v2]: https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg07490.= html [Patch v1]: https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg07336.= html