* [Qemu-devel] [Bug 1355697] [NEW] qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries
@ 2014-08-12 9:47 Maria Kustova
2014-10-21 11:02 ` [Qemu-devel] [Bug 1355697] " Max Reitz
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Maria Kustova @ 2014-08-12 9:47 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
'qemu-img check -r all/leaks' failed with a segmentation fault on the
fuzzed image with L1/L2 entry values having UINT64 border values.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.raw in the same directory
3. Execute
qemu-img check -f qcow2 -r all copy.img
Result: qemu-img was killed by SIGSEGV.
The qemu-img execution log can be found in the attached archive.
qemu.git HEAD 2d591ce2aeebf
** Affects: qemu
Importance: Undecided
Status: New
** Attachment added: "images.n.traces.tar.gz"
https://bugs.launchpad.net/bugs/1355697/+attachment/4175257/+files/images.n.traces.tar.gz
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1355697
Title:
qemu-img: Segfault on a fuzzed image with large values of L1/L2
entries
Status in QEMU:
New
Bug description:
'qemu-img check -r all/leaks' failed with a segmentation fault on the
fuzzed image with L1/L2 entry values having UINT64 border values.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.raw in the same directory
3. Execute
qemu-img check -f qcow2 -r all copy.img
Result: qemu-img was killed by SIGSEGV.
The qemu-img execution log can be found in the attached archive.
qemu.git HEAD 2d591ce2aeebf
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1355697/+subscriptions
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Qemu-devel] [Bug 1355697] Re: qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries
2014-08-12 9:47 [Qemu-devel] [Bug 1355697] [NEW] qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries Maria Kustova
@ 2014-10-21 11:02 ` Max Reitz
2014-10-21 11:10 ` Max Reitz
2016-06-28 19:29 ` T. Huth
2 siblings, 0 replies; 4+ messages in thread
From: Max Reitz @ 2014-10-21 11:02 UTC (permalink / raw)
To: qemu-devel
Hi,
This issue has at least been partially fixed in master
(5f77ef69a195098baddfdc6d189f1b4a94587378):
$ ./qemu-img check -f qcow2 -r all copy.img
Warning: cluster offset=0xfffffffffe0000 is after the end of the image file, can't properly check refcounts.
Warning: cluster offset=0x100000000000000 is after the end of the image file, can't properly check refcounts.
ERROR l2_offset=fffffffffffe00: Table is not cluster aligned; L1 entry corrupted
Repairing cluster 0 refcount=0 reference=1
Repairing cluster 1 refcount=0 reference=1
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with refcount table); further corruption events will be suppressed
Repairing cluster 21 refcount=0 reference=1
4 errors were found on the image.
Data may be corrupted, or further writes to the image may corrupt it.
2 internal errors have occurred during the check.
Image end offset: 2883584
I'm still working towards the repair function actually doing its job.
Thank you for your report,
Max
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1355697
Title:
qemu-img: Segfault on a fuzzed image with large values of L1/L2
entries
Status in QEMU:
Fix Committed
Bug description:
'qemu-img check -r all/leaks' failed with a segmentation fault on the
fuzzed image with L1/L2 entry values having UINT64 border values.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.raw in the same directory
3. Execute
qemu-img check -f qcow2 -r all copy.img
Result: qemu-img was killed by SIGSEGV.
The qemu-img execution log can be found in the attached archive.
qemu.git HEAD 2d591ce2aeebf
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1355697/+subscriptions
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Qemu-devel] [Bug 1355697] Re: qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries
2014-08-12 9:47 [Qemu-devel] [Bug 1355697] [NEW] qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries Maria Kustova
2014-10-21 11:02 ` [Qemu-devel] [Bug 1355697] " Max Reitz
@ 2014-10-21 11:10 ` Max Reitz
2016-06-28 19:29 ` T. Huth
2 siblings, 0 replies; 4+ messages in thread
From: Max Reitz @ 2014-10-21 11:10 UTC (permalink / raw)
To: qemu-devel
Hi,
Okay, so this image has the same “issue” (it's intentionally broken, so
it's not really an issue) as the one in bug 1355738: There are corrupted
L2 entries which are impossible for qemu to repair. Therefore, we could
only ask the user to use qemu-img convert and that's all we can do.
Therefore, I'm marking this fixed as well.
Max
** Changed in: qemu
Status: New => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1355697
Title:
qemu-img: Segfault on a fuzzed image with large values of L1/L2
entries
Status in QEMU:
Fix Committed
Bug description:
'qemu-img check -r all/leaks' failed with a segmentation fault on the
fuzzed image with L1/L2 entry values having UINT64 border values.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.raw in the same directory
3. Execute
qemu-img check -f qcow2 -r all copy.img
Result: qemu-img was killed by SIGSEGV.
The qemu-img execution log can be found in the attached archive.
qemu.git HEAD 2d591ce2aeebf
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1355697/+subscriptions
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Qemu-devel] [Bug 1355697] Re: qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries
2014-08-12 9:47 [Qemu-devel] [Bug 1355697] [NEW] qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries Maria Kustova
2014-10-21 11:02 ` [Qemu-devel] [Bug 1355697] " Max Reitz
2014-10-21 11:10 ` Max Reitz
@ 2016-06-28 19:29 ` T. Huth
2 siblings, 0 replies; 4+ messages in thread
From: T. Huth @ 2016-06-28 19:29 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1355697
Title:
qemu-img: Segfault on a fuzzed image with large values of L1/L2
entries
Status in QEMU:
Fix Released
Bug description:
'qemu-img check -r all/leaks' failed with a segmentation fault on the
fuzzed image with L1/L2 entry values having UINT64 border values.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.raw in the same directory
3. Execute
qemu-img check -f qcow2 -r all copy.img
Result: qemu-img was killed by SIGSEGV.
The qemu-img execution log can be found in the attached archive.
qemu.git HEAD 2d591ce2aeebf
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1355697/+subscriptions
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-28 19:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-08-12 9:47 [Qemu-devel] [Bug 1355697] [NEW] qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries Maria Kustova
2014-10-21 11:02 ` [Qemu-devel] [Bug 1355697] " Max Reitz
2014-10-21 11:10 ` Max Reitz
2016-06-28 19:29 ` T. Huth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.