[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PATCH v3 2/8] block/qcow2-refcount: avoid eating RAM
From: |
Vladimir Sementsov-Ogievskiy |
Subject: |
[Qemu-block] [PATCH v3 2/8] block/qcow2-refcount: avoid eating RAM |
Date: |
Thu, 11 Oct 2018 18:16:17 +0300 |
qcow2_inc_refcounts_imrt() (through realloc_refcount_array()) can eat
an unpredictable amount of memory on corrupted table entries, which are
referencing regions far beyond the end of file.
Prevent this, by skipping such regions from further processing.
Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
---
block/qcow2-refcount.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index b453d87a3f..afaa1a1409 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -1499,12 +1499,30 @@ int qcow2_inc_refcounts_imrt(BlockDriverState *bs,
BdrvCheckResult *res,
{
BDRVQcow2State *s = bs->opaque;
uint64_t start, last, cluster_offset, k, refcount;
+ int64_t file_len;
int ret;
if (size <= 0) {
return 0;
}
+ file_len = bdrv_getlength(bs->file->bs);
+ if (file_len < 0) {
+ return file_len;
+ }
+
+ /* Last cluster of qcow2 image may be semi-allocated, so it's may be OK to
+ * reference some space after file end but it should be less than one
+ * cluster.
+ */
+ if (offset + size - file_len >= s->cluster_size) {
+ fprintf(stderr, "ERROR: counting reference for region exceeding the "
+ "end of the file by one cluster or more: offset 0x%" PRIx64
+ " size 0x%" PRIx64 "\n", offset, size);
+ res->corruptions++;
+ return 0;
+ }
+
start = start_of_cluster(s, offset);
last = start_of_cluster(s, offset + size - 1);
for(cluster_offset = start; cluster_offset <= last;
--
2.18.0
- [Qemu-block] [PATCH v3 0/8] qcow2 check improvements, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 2/8] block/qcow2-refcount: avoid eating RAM,
Vladimir Sementsov-Ogievskiy <=
- [Qemu-block] [PATCH v3 3/8] block/qcow2-refcount: check_refcounts_l2: refactor compressed case, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 8/8] block/qcow2-refcount: fix out-of-file L2 entries, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 7/8] block/qcow2-refcount: fix out-of-file L1 entries to be zero, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 5/8] block/qcow2-refcount: check_refcounts_l2: don't count corrupted entries, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 1/8] block/qcow2-refcount: fix check_oflag_copied, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 4/8] block/qcow2-refcount: check_refcounts_l2: reduce ignored overlaps, Vladimir Sementsov-Ogievskiy, 2018/10/11
- [Qemu-block] [PATCH v3 6/8] block/qcow2-refcount: refactor fixing L2 entry, Vladimir Sementsov-Ogievskiy, 2018/10/11