Re: [PATCH v7 8/8] parallels: Add data_off check

[Denis V. Lunev]

On 7/1/23 12:07, Alexander Ivanov wrote:
> data_off field of the parallels image header can be corrupted. Check if
> this field greater than the header + BAT size and less than file size.
> Change checking code in parallels_open() accordingly.
>
> Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
This patch requires a bit more work, unfortunately.

After 'git am' it renders a bit differently as follows:

@@ -1012,18 +1076,6 @@ static int parallels_open(BlockDriverState *bs, 
QDict *options, int flags,
         ret = -ENOMEM;
         goto fail;
     }
-    s->data_start = le32_to_cpu(ph.data_off);
-    if (s->data_start == 0) {
-        s->data_start = DIV_ROUND_UP(size, BDRV_SECTOR_SIZE);
-    }
-    s->data_end = s->data_start;
-    if (s->data_end < (s->header_size >> BDRV_SECTOR_BITS)) {
-        /*
-         * There is not enough unused space to fit to block align 
between BAT
-         * and actual data. We can't avoid read-modify-write...
-         */
-        s->header_size = size;
-    }

     ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0);
     if (ret < 0) {
@@ -1035,6 +1087,21 @@ static int parallels_open(BlockDriverState *bs, 
QDict *options, int flags,
         s->header_unclean = true;
     }

+    new_data_start = parallels_test_data_off(s, file_nb_sectors);
+    if (new_data_start == 0) {
+        s->data_start = le32_to_cpu(ph.data_off);
+    } else {
+        s->data_start = new_data_start;
+    }
+    s->data_end = s->data_start;
+    if (s->data_end < (s->header_size >> BDRV_SECTOR_BITS)) {
+        /*
+         * There is not enough unused space to fit to block align 
between BAT
+         * and actual data. We can't avoid read-modify-write...
+         */
+        s->header_size = size;
+    }
+
     opts = qemu_opts_create(&parallels_runtime_opts, NULL, 0, errp);
     if (!opts) {
         goto fail_options;
@@ -1117,7 +1184,8 @@ static

I would say that we need to
1. move s->data_start/s->data_end calculations below as a separate patch
2. create patch which will change formatting of comments inside 
block/parallels.c
    in order to avoid checkpatch errors.


> ---
>   block/parallels.c | 98 +++++++++++++++++++++++++++++++++++++++--------
>   1 file changed, 83 insertions(+), 15 deletions(-)
>
> diff --git a/block/parallels.c b/block/parallels.c
> index 456a13bd28..51e79056df 100644
> --- a/block/parallels.c
> +++ b/block/parallels.c
> @@ -446,6 +446,65 @@ static void parallels_check_unclean(BlockDriverState *bs,
>       }
>   }
>   
> +/*
> + * Returns 0 if data_off is correct or returns correct offset.
> + */
> +static uint32_t parallels_test_data_off(BDRVParallelsState *s,
> +                                        int64_t file_nb_sectors)
> +{
> +    uint32_t data_off, min_off;
> +    bool old_magic;
> +
> +    old_magic = !memcmp(s->header->magic, HEADER_MAGIC, 16);
> +
> +    data_off = le32_to_cpu(s->header->data_off);
> +    if (data_off == 0 && old_magic) {
this condition is unclear for the unprepared reader
and we need to provide extensive comment with
the reference to the documentation.

> +        return 0;
> +    }
> +
> +    min_off = DIV_ROUND_UP(bat_entry_off(s->bat_size), BDRV_SECTOR_SIZE);
> +    if (!old_magic) {
> +        min_off = ROUND_UP(min_off, s->cluster_size / BDRV_SECTOR_SIZE);
> +    }
> +
> +    if (data_off >= min_off && data_off <= file_nb_sectors) {
> +        return 0;
> +    }
> +
> +    return min_off;
> +}
> +
> +static int coroutine_fn GRAPH_RDLOCK
> +parallels_check_data_off(BlockDriverState *bs, BdrvCheckResult *res,
> +                         BdrvCheckMode fix)
> +{
> +    BDRVParallelsState *s = bs->opaque;
> +    int64_t file_size;
> +    uint32_t data_off;
> +
> +    file_size = bdrv_co_nb_sectors(bs->file->bs);
> +    if (file_size < 0) {
> +        res->check_errors++;
> +        return file_size;
> +    }
> +
> +    data_off = parallels_test_data_off(s, file_size);
> +    if (data_off == 0) {
> +        return 0;
> +    }
> +
> +    res->corruptions++;
> +    if (fix & BDRV_FIX_ERRORS) {
> +        s->header->data_off = cpu_to_le32(data_off);
> +        res->corruptions_fixed++;
> +    }
> +
> +    fprintf(stderr, "%s data_off field has incorrect value\n",
> +            fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR");
> +
> +    return 0;
> +}
> +
>   static int coroutine_fn GRAPH_RDLOCK
>   parallels_check_outside_image(BlockDriverState *bs, BdrvCheckResult *res,
>                                 BdrvCheckMode fix)
> @@ -709,6 +768,11 @@ parallels_co_check(BlockDriverState *bs, BdrvCheckResult 
> *res,
>       WITH_QEMU_LOCK_GUARD(&s->lock) {
>           parallels_check_unclean(bs, res, fix);
>   
> +        ret = parallels_check_data_off(bs, res, fix);
> +        if (ret < 0) {
> +            return ret;
> +        }
> +
>           ret = parallels_check_outside_image(bs, res, fix);
>           if (ret < 0) {
>               return ret;
> @@ -947,7 +1011,7 @@ static int parallels_open(BlockDriverState *bs, QDict 
> *options, int flags,
>       BDRVParallelsState *s = bs->opaque;
>       ParallelsHeader ph;
>       int ret, size, i;
> -    int64_t file_nb_sectors, sector;
> +    int64_t file_nb_sectors, sector, new_data_start;
>       QemuOpts *opts = NULL;
>       Error *local_err = NULL;
>       char *buf;
> @@ -1008,9 +1072,22 @@ static int parallels_open(BlockDriverState *bs, QDict 
> *options, int flags,
>           ret = -ENOMEM;
>           goto fail;
>       }
> -    s->data_start = le32_to_cpu(ph.data_off);
> -    if (s->data_start == 0) {
> -        s->data_start = DIV_ROUND_UP(size, BDRV_SECTOR_SIZE);
> +
> +    ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0);
> +    if (ret < 0) {
> +        goto fail;
> +    }
> +    s->bat_bitmap = (uint32_t *)(s->header + 1);
> +
> +    if (le32_to_cpu(ph.inuse) == HEADER_INUSE_MAGIC) {
> +        s->header_unclean = true;
> +    }
> +
> +    new_data_start = parallels_test_data_off(s, file_nb_sectors);
> +    if (new_data_start == 0) {
> +        s->data_start = le32_to_cpu(ph.data_off);
> +    } else {
> +        s->data_start = new_data_start;
>       }
>       s->data_end = s->data_start;
>       if (s->data_end < (s->header_size >> BDRV_SECTOR_BITS)) {
> @@ -1019,16 +1096,6 @@ static int parallels_open(BlockDriverState *bs, QDict 
> *options, int flags,
>           s->header_size = size;
>       }
>   
> -    ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0);
> -    if (ret < 0) {
> -        goto fail;
> -    }
> -    s->bat_bitmap = (uint32_t *)(s->header + 1);
> -
> -    if (le32_to_cpu(ph.inuse) == HEADER_INUSE_MAGIC) {
> -        s->header_unclean = true;
> -    }
> -
>       opts = qemu_opts_create(&parallels_runtime_opts, NULL, 0, errp);
>       if (!opts) {
>           goto fail_options;
> @@ -1111,7 +1178,8 @@ static int parallels_open(BlockDriverState *bs, QDict 
> *options, int flags,
>        * Repair the image if it's dirty or
>        * out-of-image corruption was detected.
>        */
> -    if (s->data_end > file_nb_sectors || s->header_unclean) {
> +    if (s->data_end > file_nb_sectors || s->header_unclean
> +        || new_data_start != 0) {
>           BdrvCheckResult res;
>           ret = bdrv_check(bs, &res, BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
>           if (ret < 0) {