Skip to contentSkip to conversation

qcow2: Assert that refcount block offsets fit in the refcount table

PATCH Applied Alberto Garcia 2 participants 4 messages Nov 14, 2018 – Jan 8, 2019 Block layer

lore
Share & tools
lore

Alberto Garcia

author
#0 lore raw

PATCH v2 1/1 qcow2: Assert that refcount block offsets fit in the refcount table

Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved.

The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field.

While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU.

Signed-off-by Alberto Garcia <[email protected]>
Reviewed-by Eric Blake <[email protected]>

---
v2: Add missing Signed-off-by: line

---
 block/qcow2-refcount.c | 3 +++
 1 file changed, 3 insertions(+)
block/qcow2-refcount.c +3 -0
index 46082aeac1..31a2e1f845 100644
@@ -367,6 +367,9 @@ static int alloc_refcount_block(BlockDriverState *bs,
         return new_block;
     }
 
+    /* The offset must fit in the offset field of the refcount table entry */
+    assert((new_block & REFT_OFFSET_MASK) == new_block);
+
     /* If we're allocating the block at offset 0 then something is wrong */
     if (new_block == 0) {
         qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
Signature · 1 line
2.11.0
author
#1 lore raw

ping

I suppose this one can go in now.

Quoted 37 lines · Alberto Garcia

Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved.

The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field.

While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU.

Signed-off-by Alberto Garcia <[email protected]>
Reviewed-by Eric Blake <[email protected]>

---
v2: Add missing Signed-off-by: line

---
 block/qcow2-refcount.c | 3 +++
 1 file changed, 3 insertions(+)
block/qcow2-refcount.c +3 -0
index 46082aeac1..31a2e1f845 100644
@@ -367,6 +367,9 @@ static int alloc_refcount_block(BlockDriverState *bs,
         return new_block;
     }
 
+    /* The offset must fit in the offset field of the refcount table entry */
+    assert((new_block & REFT_OFFSET_MASK) == new_block);
+
     /* If we're allocating the block at offset 0 then something is wrong */
     if (new_block == 0) {
         qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
Signature · 1 line
2.11.0
author
#2 lore raw
In reply to Alberto Garcia

ping 2

Quoted 37 lines · Alberto Garcia

Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved.

The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field.

While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU.

Signed-off-by Alberto Garcia <[email protected]>
Reviewed-by Eric Blake <[email protected]>

---
v2: Add missing Signed-off-by: line

---
 block/qcow2-refcount.c | 3 +++
 1 file changed, 3 insertions(+)
block/qcow2-refcount.c +3 -0
index 46082aeac1..31a2e1f845 100644
@@ -367,6 +367,9 @@ static int alloc_refcount_block(BlockDriverState *bs,
         return new_block;
     }
 
+    /* The offset must fit in the offset field of the refcount table entry */
+    assert((new_block & REFT_OFFSET_MASK) == new_block);
+
     /* If we're allocating the block at offset 0 then something is wrong */
     if (new_block == 0) {
         qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
Signature · 1 line
2.11.0
Applied
#3 lore raw
In reply to Alberto Garcia

Am 14.11.2018 um 15:58 hat Alberto Garcia geschrieben:

Quoted 7 lines

Refcount table entries have a field to store the offset of the refcount block. The rest of the bits of the entry are currently reserved.

The offset is always taken from the entry using REFT_OFFSET_MASK to ensure that we only use the bits that belong to that field.

Quoted 8 lines

While that mask is used every time we read from the refcount table, it is never used when we write to it. Due to the other constraints of the qcow2 format QEMU can never produce refcount block offsets that don't fit in that field so any such offset when allocating a refcount block would indicate a bug in QEMU.

Signed-off-by Alberto Garcia <[email protected]>
Reviewed-by Eric Blake <[email protected]>

Thanks, applied to the block branch.

Kevin