[PATCH] block: Improve backing file validation

* [PATCH] block: Improve backing file validation
@ 2021-05-10  4:30 Li Zhijian
  2021-05-10  8:41 ` Daniel P. Berrangé
  0 siblings, 1 reply; 3+ messages in thread
From: Li Zhijian @ 2021-05-10  4:30 UTC (permalink / raw)
  To: kwolf, mreitz, qemu-block; +Cc: qemu-devel, Li Zhijian

Image below user cases:
case 1:
```
$ qemu-img create -f raw source.raw 1G
$ qemu-img create -f qcow2 -F raw -b source.raw ./source.raw
qemu-img info source.raw
image: source.raw
file format: qcow2
virtual size: 193K (197120 bytes)
disk size: 196K
cluster_size: 65536
backing file: source.raw <<<<<<
backing file format: raw
Format specific information:
    compat: 1.1
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
```

case 2:
```
$ qemu-img create -f raw source.raw 1G
$ ln -sf source.raw destination.qcow2
$ qemu-img create -f qcow2 -F raw -b source.raw ./destination.qcow2
qemu-img info source.raw
image: source.raw
file format: qcow2 <<<<<<
virtual size: 2.0G (2147483648 bytes)
disk size: 196K
cluster_size: 65536
backing file: source.raw
backing file format: raw
Format specific information:
    compat: 1.1
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
```
Generally, we don't expect to corrupte the source.raw anyway, while
actually it does.

Here we validate the realpath of file instead the input string.

Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
---
 block.c | 46 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/block.c b/block.c
index 9ad725d205..523845b763 100644
--- a/block.c
+++ b/block.c
@@ -6431,6 +6431,44 @@ bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
     return true;
 }
 
+static bool validate_backing_file(const char *filename,
+                                  const char *backing_file, Error **errp)
+{
+    bool ret = false;
+    char *rf, *real_filename = g_malloc0(PATH_MAX + 1);
+    char *rb, *real_backing = g_malloc0(PATH_MAX + 1);
+
+    rf = realpath(filename, real_filename);
+    if (!rf) {
+        if (errno == ENOENT) {
+            /* filename doesn't exit, ignore it */
+            rf = (char *)filename;
+        } else {
+            error_setg(errp, "Failed to resolve %s", filename);
+            goto out;
+        }
+    }
+    rb = realpath(backing_file, real_backing);
+    if (!rb) {
+        error_setg(errp, "Failed to resolve %s", backing_file);
+        goto out;
+    }
+    if (!strcmp(rf, rb)) {
+        error_setg(errp, "Error: Trying to create an image with the "
+                            "same filename as the backing file");
+        goto out;
+    }
+    if (backing_file[0] == '\0') {
+        error_setg(errp, "Expected backing file name, got empty string");
+        goto out;
+    }
+    ret = true;
+out:
+    g_free(real_filename);
+    g_free(real_backing);
+    return ret;
+}
+
 void bdrv_img_create(const char *filename, const char *fmt,
                      const char *base_filename, const char *base_fmt,
                      char *options, uint64_t img_size, int flags, bool quiet,
@@ -6507,13 +6545,7 @@ void bdrv_img_create(const char *filename, const char *fmt,
 
     backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
     if (backing_file) {
-        if (!strcmp(filename, backing_file)) {
-            error_setg(errp, "Error: Trying to create an image with the "
-                             "same filename as the backing file");
-            goto out;
-        }
-        if (backing_file[0] == '\0') {
-            error_setg(errp, "Expected backing file name, got empty string");
+        if (!validate_backing_file(filename, backing_file, errp)) {
             goto out;
         }
     }
-- 
2.30.2





^ permalink raw reply related	[flat|nested] 3+ messages in thread