From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
To: Tuguoyi <tu.guoyi@h3c.com>, "kwolf@redhat.com" <kwolf@redhat.com>,
"mreitz@redhat.com" <mreitz@redhat.com>,
"qemu-block@nongnu.org" <qemu-block@nongnu.org>
Cc: Chengchiwen <chengchiwen@h3c.com>,
"qemu-devel@nongnu.org" <qemu-devel@nongnu.org>,
Wangyongqing <w_yongqing@h3c.com>,
Changlimin <changlimin@h3c.com>, Gaoliang <liang_gao@h3c.com>,
Wangyong <wang.yongD@h3c.com>
Subject: Re: [PATCH v3] qcow2-bitmap: Fix uint64_t left-shift overflow
Date: Thu, 31 Oct 2019 13:04:29 +0000 [thread overview]
Message-ID: <e50ae813-944a-4b78-d8df-fb98594c988d@virtuozzo.com> (raw)
In-Reply-To: <f26933e80e434b5f875e7db24ef9d02f@h3c.com>
30.10.2019 14:46, Tuguoyi wrote:
> There are two issues in In check_constraints_on_bitmap(),
> 1) The sanity check on the granularity will cause uint64_t
> integer left-shift overflow when cluster_size is 2M and the
> granularity is BIGGER than 32K.
> 2) The way to calculate image size that the maximum bitmap
> supported can map to is a bit incorrect.
> This patch fix it by add a helper function to calculate the
> number of bytes needed by a normal bitmap in image and compare
> it to the maximum bitmap bytes supported by qemu.
>
> Signed-off-by: Guoyi Tu <tu.guoyi@h3c.com>
Please, where possible, mention commit where bug was introduced in
commit message. Also, add qemu-stable@nongnu.org to CC when fixing
released bugs.
Fixes: 5f72826e7fc62167cf3a
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Thanks for fixing!
> ---
> block/qcow2-bitmap.c | 15 ++++++++++++---
> 1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
> index 98294a7..34935bb 100644
> --- a/block/qcow2-bitmap.c
> +++ b/block/qcow2-bitmap.c
> @@ -142,6 +142,14 @@ static int check_table_entry(uint64_t entry, int cluster_size)
> return 0;
> }
>
> +static inline int64_t get_bitmap_bytes_needed(int64_t len,
AFAIK "inline" is no-op in this context, compiler will most probably inline it anyway,
and "inline" word don't influence on this probability. So, better drop it.
> + uint32_t granularity)
> +{
> + int64_t num_bits = DIV_ROUND_UP(len, granularity);
> +
> + return DIV_ROUND_UP(num_bits, 8);
> +}
> +
> static int check_constraints_on_bitmap(BlockDriverState *bs,
> const char *name,
> uint32_t granularity,
> @@ -150,6 +158,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
> BDRVQcow2State *s = bs->opaque;
> int granularity_bits = ctz32(granularity);
> int64_t len = bdrv_getlength(bs);
> + int64_t bitmap_bytes;
>
> assert(granularity > 0);
> assert((granularity & (granularity - 1)) == 0);
> @@ -171,9 +180,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
> return -EINVAL;
> }
>
> - if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) ||
> - (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size <<
> - granularity_bits))
> + bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
> + if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
> + (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
> {
> error_setg(errp, "Too much space will be occupied by the bitmap. "
> "Use larger granularity");
>
--
Best regards,
Vladimir
prev parent reply other threads:[~2019-10-31 13:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-30 11:46 [PATCH v3] qcow2-bitmap: Fix uint64_t left-shift overflow Tuguoyi
2019-10-31 13:04 ` Vladimir Sementsov-Ogievskiy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e50ae813-944a-4b78-d8df-fb98594c988d@virtuozzo.com \
--to=vsementsov@virtuozzo.com \
--cc=changlimin@h3c.com \
--cc=chengchiwen@h3c.com \
--cc=kwolf@redhat.com \
--cc=liang_gao@h3c.com \
--cc=mreitz@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=tu.guoyi@h3c.com \
--cc=w_yongqing@h3c.com \
--cc=wang.yongD@h3c.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).