block/qcow2-bitmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
There are two issues in In check_constraints_on_bitmap(),
1) The sanity check on the granularity will cause uint64_t
integer left-shift overflow when cluster_size is 2M and the
granularity is BIGGER than 32K.
2) The way to calculate image size that the maximum bitmap
supported can map to is a bit incorrect.
This patch fix it by add a helper function to calculate the
number of bytes needed by a normal bitmap in image and compare
it to the maximum bitmap bytes supported by qemu.
Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com>
---
block/qcow2-bitmap.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index 98294a7..34935bb 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -142,6 +142,14 @@ static int check_table_entry(uint64_t entry, int cluster_size)
return 0;
}
+static inline int64_t get_bitmap_bytes_needed(int64_t len,
+ uint32_t granularity)
+{
+ int64_t num_bits = DIV_ROUND_UP(len, granularity);
+
+ return DIV_ROUND_UP(num_bits, 8);
+}
+
static int check_constraints_on_bitmap(BlockDriverState *bs,
const char *name,
uint32_t granularity,
@@ -150,6 +158,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
BDRVQcow2State *s = bs->opaque;
int granularity_bits = ctz32(granularity);
int64_t len = bdrv_getlength(bs);
+ int64_t bitmap_bytes;
assert(granularity > 0);
assert((granularity & (granularity - 1)) == 0);
@@ -171,9 +180,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
return -EINVAL;
}
- if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) ||
- (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size <<
- granularity_bits))
+ bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
+ if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
+ (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
{
error_setg(errp, "Too much space will be occupied by the bitmap. "
"Use larger granularity");
--
2.7.4
[Patch v2]: https://lists.gnu.org/archive/html/qemu-devel/2019-10/msg07490.html
30.10.2019 14:46, Tuguoyi wrote: > There are two issues in In check_constraints_on_bitmap(), > 1) The sanity check on the granularity will cause uint64_t > integer left-shift overflow when cluster_size is 2M and the > granularity is BIGGER than 32K. > 2) The way to calculate image size that the maximum bitmap > supported can map to is a bit incorrect. > This patch fix it by add a helper function to calculate the > number of bytes needed by a normal bitmap in image and compare > it to the maximum bitmap bytes supported by qemu. > > Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com> Please, where possible, mention commit where bug was introduced in commit message. Also, add qemu-stable@nongnu.org to CC when fixing released bugs. Fixes: 5f72826e7fc62167cf3a Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Thanks for fixing! > --- > block/qcow2-bitmap.c | 15 ++++++++++++--- > 1 file changed, 12 insertions(+), 3 deletions(-) > > diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c > index 98294a7..34935bb 100644 > --- a/block/qcow2-bitmap.c > +++ b/block/qcow2-bitmap.c > @@ -142,6 +142,14 @@ static int check_table_entry(uint64_t entry, int cluster_size) > return 0; > } > > +static inline int64_t get_bitmap_bytes_needed(int64_t len, AFAIK "inline" is no-op in this context, compiler will most probably inline it anyway, and "inline" word don't influence on this probability. So, better drop it. > + uint32_t granularity) > +{ > + int64_t num_bits = DIV_ROUND_UP(len, granularity); > + > + return DIV_ROUND_UP(num_bits, 8); > +} > + > static int check_constraints_on_bitmap(BlockDriverState *bs, > const char *name, > uint32_t granularity, > @@ -150,6 +158,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs, > BDRVQcow2State *s = bs->opaque; > int granularity_bits = ctz32(granularity); > int64_t len = bdrv_getlength(bs); > + int64_t bitmap_bytes; > > assert(granularity > 0); > assert((granularity & (granularity - 1)) == 0); > @@ -171,9 +180,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs, > return -EINVAL; > } > > - if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) || > - (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size << > - granularity_bits)) > + bitmap_bytes = get_bitmap_bytes_needed(len, granularity); > + if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) || > + (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size)) > { > error_setg(errp, "Too much space will be occupied by the bitmap. " > "Use larger granularity"); > -- Best regards, Vladimir
© 2016 - 2024 Red Hat, Inc.