[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 05/17] parallels: Out of image offset in BAT leads to image inflat
From: |
Hanna Czenczek |
Subject: |
[PULL 05/17] parallels: Out of image offset in BAT leads to image inflation |
Date: |
Mon, 5 Jun 2023 17:45:29 +0200 |
From: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
data_end field in BDRVParallelsState is set to the biggest offset present
in BAT. If this offset is outside of the image, any further write will
create the cluster at this offset and/or the image will be truncated to
this offset on close. This is definitely not correct.
Raise an error in parallels_open() if data_end points outside the image
and it is not a check (let the check to repaire the image). Set data_end
to the end of the cluster with the last correct offset.
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
Message-Id: <20230424093147.197643-2-alexander.ivanov@virtuozzo.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
---
block/parallels.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/block/parallels.c b/block/parallels.c
index d8a3f13e24..7b6d770f8e 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -733,6 +733,7 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
BDRVParallelsState *s = bs->opaque;
ParallelsHeader ph;
int ret, size, i;
+ int64_t file_nb_sectors;
QemuOpts *opts = NULL;
Error *local_err = NULL;
char *buf;
@@ -742,6 +743,11 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
return ret;
}
+ file_nb_sectors = bdrv_nb_sectors(bs->file->bs);
+ if (file_nb_sectors < 0) {
+ return -EINVAL;
+ }
+
ret = bdrv_pread(bs->file, 0, sizeof(ph), &ph, 0);
if (ret < 0) {
goto fail;
@@ -806,6 +812,17 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
for (i = 0; i < s->bat_size; i++) {
int64_t off = bat2sect(s, i);
+ if (off >= file_nb_sectors) {
+ if (flags & BDRV_O_CHECK) {
+ continue;
+ }
+ error_setg(errp, "parallels: Offset %" PRIi64 " in BAT[%d] entry "
+ "is larger than file size (%" PRIi64 ")",
+ off << BDRV_SECTOR_BITS, i,
+ file_nb_sectors << BDRV_SECTOR_BITS);
+ ret = -EINVAL;
+ goto fail;
+ }
if (off >= s->data_end) {
s->data_end = off + s->tracks;
}
--
2.40.1
- [PULL 00/17] Block patches, Hanna Czenczek, 2023/06/05
- [PULL 05/17] parallels: Out of image offset in BAT leads to image inflation,
Hanna Czenczek <=
[PULL 06/17] parallels: Fix high_off calculation in parallels_co_check(), Hanna Czenczek, 2023/06/05
[PULL 04/17] iotests/iov-padding: New test, Hanna Czenczek, 2023/06/05
[PULL 11/17] parallels: Move check of cluster outside image to a separate function, Hanna Czenczek, 2023/06/05
[PULL 10/17] parallels: Move check of unclean image to a separate function, Hanna Czenczek, 2023/06/05
[PULL 12/17] parallels: Fix statistics calculation, Hanna Czenczek, 2023/06/05