From 972606c4db826f286f7f475551180502859f49b9 Mon Sep 17 00:00:00 2001 From: Fam Zheng Date: Wed, 20 Jan 2016 12:21:20 +0800 Subject: [PATCH] blockdev: Error out on negative throttling option values extract_common_blockdev_options() uses qemu_opt_get_number() to parse the bps/iops numbers to uint64_t, then converts to double and stores in ThrottleConfig. The actual parsing is done by strtoull() in parse_option_number(). Negative numbers are wrapped to large positive ones, and stored. We used to reject negative numbers since 7d81c1413c9, but this regressed when the option parsing code was changed later. Now fix this again. This time, define an arbitrary large upper limit (1e15), and check the values so both negative and impractically big numbers are caught and reported. Signed-off-by: Fam Zheng Reviewed-by: Markus Armbruster Reviewed-by: Alberto Garcia Signed-off-by: Kevin Wolf --- blockdev.c | 3 ++- include/qemu/throttle.h | 2 ++ util/throttle.c | 16 ++++++---------- 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/blockdev.c b/blockdev.c index 1392fffaaa..07cfe25e1e 100644 --- a/blockdev.c +++ b/blockdev.c @@ -348,7 +348,8 @@ static bool check_throttle_config(ThrottleConfig *cfg, Error **errp) } if (!throttle_is_valid(cfg)) { - error_setg(errp, "bps/iops/maxs values must be 0 or greater"); + error_setg(errp, "bps/iops/max values must be within [0, %lld]", + THROTTLE_VALUE_MAX); return false; } diff --git a/include/qemu/throttle.h b/include/qemu/throttle.h index 12faaad959..d0c98ed25b 100644 --- a/include/qemu/throttle.h +++ b/include/qemu/throttle.h @@ -29,6 +29,8 @@ #include "qemu-common.h" #include "qemu/timer.h" +#define THROTTLE_VALUE_MAX 1000000000000000LL + typedef enum { THROTTLE_BPS_TOTAL, THROTTLE_BPS_READ, diff --git a/util/throttle.c b/util/throttle.c index 1113671ecf..af4bc95ba3 100644 --- a/util/throttle.c +++ b/util/throttle.c @@ -282,22 +282,18 @@ bool throttle_conflicting(ThrottleConfig *cfg) */ bool throttle_is_valid(ThrottleConfig *cfg) { - bool invalid = false; int i; for (i = 0; i < BUCKETS_COUNT; i++) { - if (cfg->buckets[i].avg < 0) { - invalid = true; + if (cfg->buckets[i].avg < 0 || + cfg->buckets[i].max < 0 || + cfg->buckets[i].avg > THROTTLE_VALUE_MAX || + cfg->buckets[i].max > THROTTLE_VALUE_MAX) { + return false; } } - for (i = 0; i < BUCKETS_COUNT; i++) { - if (cfg->buckets[i].max < 0) { - invalid = true; - } - } - - return !invalid; + return true; } /* check if bps_max/iops_max is used without bps/iops