mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-25 20:03:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

qcow2: Fix refcount blocks beyond image end

Browse Source 
If the qcow2 check function detects a refcount block located beyond the
image end, grow the image appropriately. This cannot break anything and
is the logical fix for such a case.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Max Reitz 2014-10-22 14:09:38 +02:00 committed by Kevin Wolf
parent 9696df219a
commit 001c158def
1 changed files with 63 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
block/qcow2-refcount.c
View File

@ -1575,7 +1575,7 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
int64_t *nb_clusters)
{
BDRVQcowState *s = bs->opaque;
int64_t i;
int64_t i, size;
int ret;
for(i = 0; i < s->refcount_table_size; i++) {
@ -1592,9 +1592,68 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
}
if (cluster >= *nb_clusters) {
fprintf(stderr, "ERROR refcount block %" PRId64
" is outside image\n", i);
res->corruptions++;
fprintf(stderr, "%s refcount block %" PRId64 " is outside image\n",
fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", i);
if (fix & BDRV_FIX_ERRORS) {
int64_t old_nb_clusters = *nb_clusters;
uint16_t *new_refcount_table;
if (offset > INT64_MAX - s->cluster_size) {
ret = -EINVAL;
goto resize_fail;
}
ret = bdrv_truncate(bs->file, offset + s->cluster_size);
if (ret < 0) {
goto resize_fail;
}
size = bdrv_getlength(bs->file);
if (size < 0) {
ret = size;
goto resize_fail;
}
*nb_clusters = size_to_clusters(s, size);
assert(*nb_clusters >= old_nb_clusters);
new_refcount_table = g_try_realloc(*refcount_table,
*nb_clusters *
sizeof(**refcount_table));
if (!new_refcount_table) {
*nb_clusters = old_nb_clusters;
res->check_errors++;
return -ENOMEM;
}
*refcount_table = new_refcount_table;
memset(*refcount_table + old_nb_clusters, 0,
(*nb_clusters - old_nb_clusters) *
sizeof(**refcount_table));
if (cluster >= *nb_clusters) {
ret = -EINVAL;
goto resize_fail;
}
res->corruptions_fixed++;
ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
offset, s->cluster_size);
if (ret < 0) {
return ret;
}
/* No need to check whether the refcount is now greater than 1:
* This area was just allocated and zeroed, so it can only be
* exactly 1 after inc_refcounts() */
continue;
resize_fail:
res->corruptions++;
fprintf(stderr, "ERROR could not resize image: %s\n",
strerror(-ret));
} else {
res->corruptions++;
}
continue;
}