dfaggioli/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcow2-bitmap: Fix uint64_t left-shift overflow

Browse Source 
There are two issues in In check_constraints_on_bitmap(),
1) The sanity check on the granularity will cause uint64_t
integer left-shift overflow when cluster_size is 2M and the
granularity is BIGGER than 32K.
2) The way to calculate image size that the maximum bitmap
supported can map to is a bit incorrect.
This patch fix it by add a helper function to calculate the
number of bytes needed by a normal bitmap in image and compare
it to the maximum bitmap bytes supported by qemu.

Fixes: 5f72826e7f
Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com>
Message-id: 4ba40cd1e7ee4a708b40899952e49f22@h3c.com
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
Tuguoyi
2019-11-01 07:37:35 +00:00
committed by Max Reitz
parent d0f90e1423
commit 570542ecb1
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
block/qcow2-bitmap.c
View File

@@ -142,6 +142,13 @@ static int check_table_entry(uint64_t entry, int cluster_size)
return 0; return 0;
} }
static int64_t get_bitmap_bytes_needed(int64_t len, uint32_t granularity)
{
int64_t num_bits = DIV_ROUND_UP(len, granularity);
return DIV_ROUND_UP(num_bits, 8);
}
static int check_constraints_on_bitmap(BlockDriverState *bs, static int check_constraints_on_bitmap(BlockDriverState *bs,
const char *name, const char *name,
uint32_t granularity, uint32_t granularity,
@@ -150,6 +157,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
BDRVQcow2State *s = bs->opaque; BDRVQcow2State *s = bs->opaque;
int granularity_bits = ctz32(granularity); int granularity_bits = ctz32(granularity);
int64_t len = bdrv_getlength(bs); int64_t len = bdrv_getlength(bs);
int64_t bitmap_bytes;
assert(granularity > 0); assert(granularity > 0);
assert((granularity & (granularity - 1)) == 0); assert((granularity & (granularity - 1)) == 0);
@@ -171,9 +179,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
return -EINVAL; return -EINVAL;
} }
if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) || bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
(len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size << if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
granularity_bits)) (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
{ {
error_setg(errp, "Too much space will be occupied by the bitmap. " error_setg(errp, "Too much space will be occupied by the bitmap. "
"Use larger granularity"); "Use larger granularity");