block: Catch integer overflow in bdrv_rw_co()
Insanely large requests could cause an integer overflow in bdrv_rw_co() while converting sectors to bytes. This patch catches the problem and returns an error (if we hadn't overflown the integer here, bdrv_check_byte_request() would have rejected the request, so we're not breaking anything that was supposed to work before). We actually do have a test case that triggers behaviour where we accidentally let such a request pass, so that it would return success, but read 0 bytes instead of the requested 4 GB. It fails now like it should. If the vdi block driver wants to be able to deal with huge images, it can't read the whole block bitmap at once into memory like it does today, but needs to use a metadata cache like qcow2 does. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
parent
1dd3a44753
commit
da15ee5134
4
block.c
4
block.c
|
@ -2690,6 +2690,10 @@ static int bdrv_rw_co(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
|
||||||
.iov_len = nb_sectors * BDRV_SECTOR_SIZE,
|
.iov_len = nb_sectors * BDRV_SECTOR_SIZE,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
if (nb_sectors < 0 || nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
qemu_iovec_init_external(&qiov, &iov, 1);
|
qemu_iovec_init_external(&qiov, &iov, 1);
|
||||||
return bdrv_prwv_co(bs, sector_num << BDRV_SECTOR_BITS,
|
return bdrv_prwv_co(bs, sector_num << BDRV_SECTOR_BITS,
|
||||||
&qiov, is_write, flags);
|
&qiov, is_write, flags);
|
||||||
|
|
|
@ -4,10 +4,7 @@ QA output created by 084
|
||||||
|
|
||||||
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
||||||
Test 1: Maximum size (1024 TB):
|
Test 1: Maximum size (1024 TB):
|
||||||
image: TEST_DIR/t.IMGFMT
|
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Could not open 'TEST_DIR/t.IMGFMT': Invalid argument
|
||||||
file format: IMGFMT
|
|
||||||
virtual size: 1024T (1125899905794048 bytes)
|
|
||||||
cluster_size: 1048576
|
|
||||||
|
|
||||||
Test 2: Size too large (1024TB + 1)
|
Test 2: Size too large (1024TB + 1)
|
||||||
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported VDI image size (size is 0x3fffffff10000, max supported is 0x3fffffff00000)
|
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported VDI image size (size is 0x3fffffff10000, max supported is 0x3fffffff00000)
|
||||||
|
|
Loading…
Reference in New Issue