From nobody Fri Oct 24 13:14:17 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1519922134010168.81041540883496; Thu, 1 Mar 2018 08:35:34 -0800 (PST) Received: from localhost ([::1]:57963 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1erRB2-0005LG-UX for importer@patchew.org; Thu, 01 Mar 2018 11:35:28 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41353) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1erR46-0008BW-HQ for qemu-devel@nongnu.org; Thu, 01 Mar 2018 11:28:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1erR41-0004Jx-Fj for qemu-devel@nongnu.org; Thu, 01 Mar 2018 11:28:18 -0500 Received: from fanzine.igalia.com ([91.117.99.155]:54919) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1erR40-0003uK-TM; Thu, 01 Mar 2018 11:28:13 -0500 Received: from [194.100.51.2] (helo=perseus.local) by fanzine.igalia.com with esmtpsa (Cipher TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim) id 1erR3P-0003Df-IZ; Thu, 01 Mar 2018 17:27:35 +0100 Received: from berto by perseus.local with local (Exim 4.89) (envelope-from ) id 1erR36-0004Oa-U9; Thu, 01 Mar 2018 18:27:16 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=References:In-Reply-To:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From; bh=BCwcELryjpTPhmvQNazAW2Yos7og3MqTalTG/q4X/o0=; b=kRS/SgkY/05+ATnokuONKxn7NZjcPSRhwM9IBZ0LYtD7R/oHDaviSaRtyV3hTVdUXzu82YGa6AXVpSsq6qDH4t9X8/Lcvhch/XoBxfnjfjMwZTJWw6F8dEj7WJZ1MriOlgjV8JSHNu83C6HEns+omdDboeVn/5i1gu9LZTU+OyKI4dOoWetAI+G2Oz16QklTrYJVPsLXKvbiiHZKP1d7XxGhuefEWABBDd5DPKGjvY2zeLlLaAKqAKOMXfZcOiLECmiPsyiV8Tv8UkuCcfs8FVfiBVVoI+PgmvsoLwkgSVZRU18wIVyeIqG7XlOAomSv77xvEEKd+emeO4fdrBRf7A==; From: Alberto Garcia To: qemu-devel@nongnu.org Date: Thu, 1 Mar 2018 18:27:12 +0200 Message-Id: X-Mailer: git-send-email 2.11.0 In-Reply-To: References: In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x (no timestamps) [generic] [fuzzy] X-Received-From: 91.117.99.155 Subject: [Qemu-devel] [PATCH 6/7] qcow2: Check snapshot L1 table in qcow2_snapshot_delete() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Alberto Garcia , qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This function deletes a snapshot from disk, removing its entry from the snapshot table, freeing its L1 table and decreasing the refcounts of all clusters. The L1 table offset and size are however not validated. If we use invalid values in this function we'll probably corrupt the image even more, so we should return an error instead. We now have a function to take care of this, so let's use it. Signed-off-by: Alberto Garcia Reviewed-by: Eric Blake --- block/qcow2-snapshot.c | 7 +++++++ tests/qemu-iotests/080 | 2 ++ tests/qemu-iotests/080.out | 2 ++ 3 files changed, 11 insertions(+) diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c index f1be5506a2..727a3d79de 100644 --- a/block/qcow2-snapshot.c +++ b/block/qcow2-snapshot.c @@ -608,6 +608,13 @@ int qcow2_snapshot_delete(BlockDriverState *bs, } sn =3D s->snapshots[snapshot_index]; =20 + ret =3D qcow2_validate_table(bs, sn.l1_table_offset, sn.l1_size, + sizeof(uint64_t), QCOW_MAX_L1_SIZE, + "Snapshot L1 table", errp); + if (ret < 0) { + return ret; + } + /* Remove it from the snapshot list */ memmove(s->snapshots + snapshot_index, s->snapshots + snapshot_index + 1, diff --git a/tests/qemu-iotests/080 b/tests/qemu-iotests/080 index 538857310f..f8e7d6f4df 100755 --- a/tests/qemu-iotests/080 +++ b/tests/qemu-iotests/080 @@ -181,6 +181,7 @@ poke_file "$TEST_IMG" "$offset_snap1_l1_offset" "\x00\x= 00\x00\x00\x00\x40\x02\x0 { $QEMU_IO -c "open -o overlap-check.inactive-l2=3Don $TEST_IMG" \ -c 'write 0 4k'; } 2>&1 | _filter_qemu_io | _filter_testdir { $QEMU_IMG snapshot -a test $TEST_IMG; } 2>&1 | _filter_testdir +{ $QEMU_IMG snapshot -d test $TEST_IMG; } 2>&1 | _filter_testdir =20 echo echo "=3D=3D Invalid snapshot L1 table size =3D=3D" @@ -193,6 +194,7 @@ poke_file "$TEST_IMG" "$offset_snap1_l1_size" "\x10\x00= \x00\x00" { $QEMU_IO -c "open -o overlap-check.inactive-l2=3Don $TEST_IMG" \ -c 'write 0 4k'; } 2>&1 | _filter_qemu_io | _filter_testdir { $QEMU_IMG snapshot -a test $TEST_IMG; } 2>&1 | _filter_testdir +{ $QEMU_IMG snapshot -d test $TEST_IMG; } 2>&1 | _filter_testdir =20 # success, all done echo "*** done" diff --git a/tests/qemu-iotests/080.out b/tests/qemu-iotests/080.out index 35c768aff3..f16fd59053 100644 --- a/tests/qemu-iotests/080.out +++ b/tests/qemu-iotests/080.out @@ -68,6 +68,7 @@ qemu-img: Error while amending options: Invalid argument Failed to flush the refcount block cache: Invalid argument write failed: Invalid argument qemu-img: Could not apply snapshot 'test': Failed to load snapshot: Invali= d argument +qemu-img: Could not delete snapshot 'test': Snapshot L1 table offset inval= id =20 =3D=3D Invalid snapshot L1 table size =3D=3D Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D67108864 @@ -78,4 +79,5 @@ qemu-img: Error while amending options: File too large Failed to flush the refcount block cache: File too large write failed: File too large qemu-img: Could not apply snapshot 'test': Failed to load snapshot: File t= oo large +qemu-img: Could not delete snapshot 'test': Snapshot L1 table too large *** done --=20 2.11.0