There are two issues in In check_constraints_on_bitmap(),
1) The sanity check on the granularity will cause uint64_t
integer left-shift overflow when cluster_size is 2M and the
granularity is BIGGER than 32K.
2) The way to calculate image size that the maximum bitmap
supported can map to is a bit incorrect.
This patch fix it by add a helper function to calculate the
number of bytes needed by a normal bitmap in image and compare
it to the maximum bitmap bytes supported by qemu.

Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com>
---
 block/qcow2-bitmap.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index 98294a7..34935bb 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -142,6 +142,14 @@ static int check_table_entry(uint64_t entry, int cluster_size)
     return 0;
 }
 
+static inline int64_t get_bitmap_bytes_needed(int64_t len,
+                                              uint32_t granularity)
+{
+    int64_t num_bits = DIV_ROUND_UP(len, granularity);
+
+    return DIV_ROUND_UP(num_bits, 8);
+}
+
 static int check_constraints_on_bitmap(BlockDriverState *bs,
                                        const char *name,
                                        uint32_t granularity,
@@ -150,6 +158,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
     BDRVQcow2State *s = bs->opaque;
     int granularity_bits = ctz32(granularity);
     int64_t len = bdrv_getlength(bs);
+    int64_t bitmap_bytes;
 
     assert(granularity > 0);
     assert((granularity & (granularity - 1)) == 0);
@@ -171,9 +180,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
         return -EINVAL;
     }
 
-    if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) ||
-        (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size <<
-               granularity_bits))
+    bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
+    if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
+        (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
     {
         error_setg(errp, "Too much space will be occupied by the bitmap. "
                    "Use larger granularity");
-- 
2.7.4

[Patch v2]: https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg07490.html

30.10.2019 14:46, Tuguoyi wrote:
> There are two issues in In check_constraints_on_bitmap(),
> 1) The sanity check on the granularity will cause uint64_t
> integer left-shift overflow when cluster_size is 2M and the
> granularity is BIGGER than 32K.
> 2) The way to calculate image size that the maximum bitmap
> supported can map to is a bit incorrect.
> This patch fix it by add a helper function to calculate the
> number of bytes needed by a normal bitmap in image and compare
> it to the maximum bitmap bytes supported by qemu.
> 
> Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com>

Please, where possible, mention commit where bug was introduced in
commit message. Also, add qemu-stable@nongnu.org to CC when fixing
released bugs.


Fixes: 5f72826e7fc62167cf3a
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Thanks for fixing!

> ---
>   block/qcow2-bitmap.c | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
> index 98294a7..34935bb 100644
> --- a/block/qcow2-bitmap.c
> +++ b/block/qcow2-bitmap.c
> @@ -142,6 +142,14 @@ static int check_table_entry(uint64_t entry, int cluster_size)
>       return 0;
>   }
>   
> +static inline int64_t get_bitmap_bytes_needed(int64_t len,

AFAIK "inline" is no-op in this context, compiler will most probably inline it anyway,
and "inline" word don't influence on this probability. So, better drop it.

> +                                              uint32_t granularity)
> +{
> +    int64_t num_bits = DIV_ROUND_UP(len, granularity);
> +
> +    return DIV_ROUND_UP(num_bits, 8);
> +}
> +
>   static int check_constraints_on_bitmap(BlockDriverState *bs,
>                                          const char *name,
>                                          uint32_t granularity,
> @@ -150,6 +158,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
>       BDRVQcow2State *s = bs->opaque;
>       int granularity_bits = ctz32(granularity);
>       int64_t len = bdrv_getlength(bs);
> +    int64_t bitmap_bytes;
>   
>       assert(granularity > 0);
>       assert((granularity & (granularity - 1)) == 0);
> @@ -171,9 +180,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
>           return -EINVAL;
>       }
>   
> -    if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) ||
> -        (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size <<
> -               granularity_bits))
> +    bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
> +    if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
> +        (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
>       {
>           error_setg(errp, "Too much space will be occupied by the bitmap. "
>                      "Use larger granularity");
> 


-- 
Best regards,
Vladimir