motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 00:03:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

Block pull request

Browse source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTOvM0AAoJEJykq7OBq3PIx0sH/0TKpaRIVq+CLpT783tEExuz
 QWTUIc69CQn/+E4kb0p7m76i9E7FPd0Ye9JhC5u6lLVdkkFIvAavCpCf4OyCQfqi
 Q+y7DxPYfWKbg3PnQuzezLFu/euucAU217nW/4B2S1lx3ceVDiSPcAN2Ar/9UcJ1
 9YXKpST3dTwZmCJdAfQ/fsbqJybtfC76uGsO2nHkqr6FOWMdB+tMyEkNh1lNnFsn
 HEBJRk71e/d5RyWiWXNVS77gNtjvSfGoJvD/+WZsqmeNNRslgtMlY2nhc38tpM38
 +au6Arbi6lv8+dE7hZcrgF7QEy/sBlM8MLhdW2hCRmqeGXhx1lw3Yen1+tVc9Bk=
 =NGXr
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Block pull request

# gpg: Signature made Tue 01 Apr 2014 18:11:16 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request: (51 commits)
  qcow2: link all L2 meta updates in preallocate()
  parallels: Sanity check for s->tracks (CVE-2014-0142)
  parallels: Fix catalog size integer overflow (CVE-2014-0143)
  qcow2: Limit snapshot table size
  qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() (CVE-2014-0143)
  qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)
  qcow2: Fix NULL dereference in qcow2_open() error path (CVE-2014-0146)
  qcow2: Fix copy_sectors() with VM state
  block: Limit request size (CVE-2014-0143)
  block: vdi bounds check qemu-io tests
  dmg: prevent chunk buffer overflow (CVE-2014-0145)
  dmg: use uint64_t consistently for sectors and lengths
  dmg: sanitize chunk length and sectorcount (CVE-2014-0145)
  dmg: use appropriate types when reading chunks
  dmg: drop broken bdrv_pread() loop
  dmg: prevent out-of-bounds array access on terminator
  dmg: coding style and indentation cleanup
  qcow2: Fix new L1 table size check (CVE-2014-0143)
  qcow2: Protect against some integer overflows in bdrv_check
  qcow2: Fix types in qcow2_alloc_clusters and alloc_clusters_noref
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2014-04-01 18:23:28 +01:00
commit 53e11bd384
38 changed files with 1562 additions and 300 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/qemu-iotests/026.out
View file

@ -475,7 +475,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
Event: refblock_alloc.write_blocks; errno: 28; imm: off; once: off; write
write failed: No space left on device
10 leaked clusters were found on the image.
11 leaked clusters were found on the image.
This means waste of disk space, but no harm to data.
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
@ -499,7 +499,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
Event: refblock_alloc.write_table; errno: 28; imm: off; once: off; write
write failed: No space left on device
10 leaked clusters were found on the image.
11 leaked clusters were found on the image.
This means waste of disk space, but no harm to data.
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
@ -523,7 +523,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
Event: refblock_alloc.switch_table; errno: 28; imm: off; once: off; write
write failed: No space left on device
10 leaked clusters were found on the image.
11 leaked clusters were found on the image.
This means waste of disk space, but no harm to data.
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824

40
tests/qemu-iotests/029
View file

@ -1,7 +1,6 @@
#!/bin/bash
#
# Test loading internal snapshots where the L1 table of the snapshot
# is smaller than the current L1 table.
# qcow2 internal snapshots/VM state tests
#
# Copyright (C) 2011 Red Hat, Inc.
#
@ -31,7 +30,8 @@ status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
rm -f $TEST_IMG.snap
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
@ -45,6 +45,14 @@ _supported_fmt qcow2
_supported_proto generic
_supported_os Linux
offset_size=24
offset_l1_size=36
echo
echo Test loading internal snapshots where the L1 table of the snapshot
echo is smaller than the current L1 table.
echo
CLUSTER_SIZE=65536
_make_test_img 64M
$QEMU_IMG snapshot -c foo "$TEST_IMG"
@ -59,6 +67,32 @@ $QEMU_IO -c 'write -b 0 4M' "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -a foo "$TEST_IMG"
_check_test_img
echo
echo Try using a huge VM state
echo
CLUSTER_SIZE=65536
_make_test_img 64M
{ $QEMU_IO -c "write -b -P 0x11 1T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IMG snapshot -c foo $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IMG snapshot -a foo $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IO -c "read -b -P 0x11 1T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
_check_test_img
echo
echo "qcow2_snapshot_load_tmp() should take the L1 size from the snapshot"
echo
CLUSTER_SIZE=512
_make_test_img 64M
{ $QEMU_IMG snapshot -c foo $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_size" "\x00\x00\x00\x00\x00\x00\x02\x00"
poke_file "$TEST_IMG" "$offset_l1_size" "\x00\x00\x00\x01"
{ $QEMU_IMG convert -s foo $TEST_IMG $TEST_IMG.snap; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full

17
tests/qemu-iotests/029.out
View file

@ -1,4 +1,8 @@
QA output created by 029
Test loading internal snapshots where the L1 table of the snapshot
is smaller than the current L1 table.
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
wrote 4096/4096 bytes at offset 0
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
@ -7,4 +11,17 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216
wrote 4194304/4194304 bytes at offset 0
4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
No errors were found on the image.
Try using a huge VM state
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
wrote 4096/4096 bytes at offset 1099511627776
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
read 4096/4096 bytes at offset 1099511627776
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
No errors were found on the image.
qcow2_snapshot_load_tmp() should take the L1 size from the snapshot
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
*** done

2
tests/qemu-iotests/044.out
View file

@ -1,6 +1,6 @@
No errors were found on the image.
7292415/33554432 = 21.73% allocated, 0.00% fragmented, 0.00% compressed clusters
Image end offset: 4296448000
Image end offset: 4296152064
.
----------------------------------------------------------------------
Ran 1 tests

106
tests/qemu-iotests/075 Executable file
View file

@ -0,0 +1,106 @@
#!/bin/bash
#
# cloop format input validation tests
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=stefanha@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
_supported_fmt cloop
_supported_proto generic
_supported_os Linux
block_size_offset=128
n_blocks_offset=132
offsets_offset=136
echo
echo "== check that the first sector can be read =="
_use_sample_img simple-pattern.cloop.bz2
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== check that the last sector can be read =="
_use_sample_img simple-pattern.cloop.bz2
$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== block_size must be a multiple of 512 =="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== block_size cannot be zero =="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x00\x00"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== huge block_size ==="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$block_size_offset" "\xff\xff\xfe\x00"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== offsets_size overflow ==="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$n_blocks_offset" "\xff\xff\xff\xff"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== refuse images that require too many offsets ==="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$n_blocks_offset" "\x04\x00\x00\x01"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== refuse images with non-monotonically increasing offsets =="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\xff\xff\xff\xff"
poke_file "$TEST_IMG" $((offsets_offset + 8)) "\x00\x00\x00\x00\xff\xfe\x00\x00"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== refuse images with invalid compressed block size =="
_use_sample_img simple-pattern.cloop.bz2
poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
poke_file "$TEST_IMG" $((offsets_offset + 8)) "\xff\xff\xff\xff\xff\xff\xff\xff"
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full
status=0

38
tests/qemu-iotests/075.out Normal file
View file

@ -0,0 +1,38 @@
QA output created by 075
== check that the first sector can be read ==
read 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== check that the last sector can be read ==
read 512/512 bytes at offset 1048064
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== block_size must be a multiple of 512 ==
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512
no file open, try 'help open'
== block_size cannot be zero ==
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size cannot be zero
no file open, try 'help open'
== huge block_size ===
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 4294966784 must be 64 MB or less
no file open, try 'help open'
== offsets_size overflow ===
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: n_blocks 4294967295 must be 536870911 or less
no file open, try 'help open'
== refuse images that require too many offsets ===
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: image requires too many offsets, try increasing block size
no file open, try 'help open'
== refuse images with non-monotonically increasing offsets ==
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: offsets not monotonically increasing at index 1, image file is corrupt
no file open, try 'help open'
== refuse images with invalid compressed block size ==
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: invalid compressed block size at index 1, image file is corrupt
no file open, try 'help open'
*** done

76
tests/qemu-iotests/076 Executable file
View file

@ -0,0 +1,76 @@
#!/bin/bash
#
# parallels format input validation tests
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=kwolf@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
_supported_fmt parallels
_supported_proto generic
_supported_os Linux
tracks_offset=$((0x1c))
catalog_entries_offset=$((0x20))
nb_sectors_offset=$((0x24))
echo
echo "== Read from a valid (enough) image =="
_use_sample_img fake.parallels.bz2
{ $QEMU_IO -c "read -P 0x11 0 64k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Negative catalog size =="
_use_sample_img fake.parallels.bz2
poke_file "$TEST_IMG" "$catalog_entries_offset" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Overflow in catalog allocation =="
_use_sample_img fake.parallels.bz2
poke_file "$TEST_IMG" "$nb_sectors_offset" "\xff\xff\xff\xff"
poke_file "$TEST_IMG" "$catalog_entries_offset" "\x01\x00\x00\x40"
{ $QEMU_IO -c "read 64M 64M" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Zero sectors per track =="
_use_sample_img fake.parallels.bz2
poke_file "$TEST_IMG" "$tracks_offset" "\x00\x00\x00\x00"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full
status=0

18
tests/qemu-iotests/076.out Normal file
View file

@ -0,0 +1,18 @@
QA output created by 076
== Read from a valid (enough) image ==
read 65536/65536 bytes at offset 0
64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== Negative catalog size ==
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
no file open, try 'help open'
== Overflow in catalog allocation ==
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
no file open, try 'help open'
== Zero sectors per track ==
qemu-io: can't open device TEST_DIR/fake.parallels: Invalid image: Zero sectors per track
no file open, try 'help open'
*** done

87
tests/qemu-iotests/078 Executable file
View file

@ -0,0 +1,87 @@
#!/bin/bash
#
# bochs format input validation tests
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=kwolf@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
_supported_fmt bochs
_supported_proto generic
_supported_os Linux
catalog_size_offset=$((0x48))
extent_size_offset=$((0x50))
disk_size_offset=$((0x58))
echo
echo "== Read from a valid image =="
_use_sample_img empty.bochs.bz2
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Negative catalog size =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Overflow for catalog size * sizeof(uint32_t) =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$catalog_size_offset" "\x00\x00\x00\x40"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Too small catalog bitmap for image size =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$disk_size_offset" "\x00\xc0\x0f\x00\x00\x00\x00\x7f"
{ $QEMU_IO -c "read 2T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Negative extent size =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$extent_size_offset" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 768k 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Zero extent size =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$extent_size_offset" "\x00\x00\x00\x00"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full
status=0

26
tests/qemu-iotests/078.out Normal file
View file

@ -0,0 +1,26 @@
QA output created by 078
== Read from a valid image ==
read 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== Negative catalog size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large
no file open, try 'help open'
== Overflow for catalog size * sizeof(uint32_t) ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large
no file open, try 'help open'
== Too small catalog bitmap for image size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size
no file open, try 'help open'
== Negative extent size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Extent size 4294967295 is too large
no file open, try 'help open'
== Zero extent size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Extent size may not be zero
no file open, try 'help open'
*** done

180
tests/qemu-iotests/080 Executable file
View file

@ -0,0 +1,180 @@
#!/bin/bash
#
# qcow2 format input validation tests
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=kwolf@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
rm -f $TEST_IMG.snap
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
_supported_fmt qcow2
_supported_proto generic
_supported_os Linux
header_size=104
offset_backing_file_offset=8
offset_backing_file_size=16
offset_l1_size=36
offset_l1_table_offset=40
offset_refcount_table_offset=48
offset_refcount_table_clusters=56
offset_nb_snapshots=60
offset_snapshots_offset=64
offset_header_size=100
offset_ext_magic=$header_size
offset_ext_size=$((header_size + 4))
offset_l2_table_0=$((0x40000))
offset_snap1=$((0x70000))
offset_snap1_l1_offset=$((offset_snap1 + 0))
offset_snap1_l1_size=$((offset_snap1 + 8))
echo
echo "== Huge header size =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_header_size" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_header_size" "\x7f\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Huge unknown header extension =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_backing_file_offset" "\xff\xff\xff\xff\xff\xff\xff\xff"
poke_file "$TEST_IMG" "$offset_ext_magic" "\x12\x34\x56\x78"
poke_file "$TEST_IMG" "$offset_ext_size" "\x7f\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_backing_file_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Huge refcount table size =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\x00\x02\x00\x01"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Misaligned refcount table =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_refcount_table_offset" "\x12\x34\x56\x78\x90\xab\xcd\xef"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Huge refcount offset =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_refcount_table_offset" "\xff\xff\xff\xff\xff\xff\x00\x00"
poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\x00\x00\x00\x7f"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid snapshot table =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_nb_snapshots" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x7f\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_snapshots_offset" "\xff\xff\xff\xff\xff\xff\x00\x00"
poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x00\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_snapshots_offset" "\x12\x34\x56\x78\x90\xab\xcd\xef"
poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x00\x00\x00"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Hitting snapshot table size limit =="
_make_test_img 64M
# Put the refcount table in a more or less safe place (16 MB)
poke_file "$TEST_IMG" "$offset_snapshots_offset" "\x00\x00\x00\x00\x01\x00\x00\x00"
poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x01\x00\x00"
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_testdir
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid L1 table =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_l1_size" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l1_size" "\x7f\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l1_table_offset" "\x7f\xff\xff\xff\xff\xff\x00\x00"
poke_file "$TEST_IMG" "$offset_l1_size" "\x00\x00\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l1_table_offset" "\x12\x34\x56\x78\x90\xab\xcd\xef"
poke_file "$TEST_IMG" "$offset_l1_size" "\x00\x00\x00\x01"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid L1 table (with internal snapshot in the image) =="
_make_test_img 64M
{ $QEMU_IMG snapshot -c foo $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l1_size" "\x00\x00\x00\x00"
_img_info
echo
echo "== Invalid backing file size =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_backing_file_offset" "\x00\x00\x00\x00\x00\x00\x10\x00"
poke_file "$TEST_IMG" "$offset_backing_file_size" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid L2 entry (huge physical offset) =="
_make_test_img 64M
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l2_table_0" "\xbf\xff\xff\xff\xff\xff\x00\x00"
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_l2_table_0" "\x80\x00\x00\xff\xff\xff\x00\x00"
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid snapshot L1 table =="
_make_test_img 64M
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_testdir
poke_file "$TEST_IMG" "$offset_snap1_l1_size" "\x10\x00\x00\x00"
{ $QEMU_IMG convert -s test $TEST_IMG $TEST_IMG.snap; } 2>&1 | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full
status=0

83
tests/qemu-iotests/080.out Normal file
View file

@ -0,0 +1,83 @@
QA output created by 080
== Huge header size ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
no file open, try 'help open'
== Huge unknown header extension ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid backing file offset
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Header extension too large
no file open, try 'help open'
== Huge refcount table size ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
no file open, try 'help open'
== Misaligned refcount table ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
no file open, try 'help open'
== Huge refcount offset ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
no file open, try 'help open'
== Invalid snapshot table ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
no file open, try 'help open'
== Hitting snapshot table size limit ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-img: Could not create snapshot 'test': -27 (File too large)
read 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== Invalid L1 table ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
no file open, try 'help open'
== Invalid L1 table (with internal snapshot in the image) ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': L1 table is too small
== Invalid backing file size ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.qcow2: Backing file name too long
no file open, try 'help open'
== Invalid L2 entry (huge physical offset) ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
wrote 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
qemu-img: Could not create snapshot 'test': -27 (File too large)
qemu-img: Could not create snapshot 'test': -11 (Resource temporarily unavailable)
== Invalid snapshot L1 table ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
wrote 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
qemu-img: Failed to load snapshot: Snapshot L1 table too large
*** done

104
tests/qemu-iotests/084 Executable file
View file

@ -0,0 +1,104 @@
#!/bin/bash
#
# Test case for VDI header corruption; image too large, and too many blocks
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=jcody@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
# This tests vdi-specific header fields
_supported_fmt vdi
_supported_proto generic
_supported_os Linux
ds_offset=368 # disk image size field offset
bs_offset=376 # block size field offset
bii_offset=384 # block in image field offset
echo
echo "=== Testing image size bounds ==="
echo
_make_test_img 64M
# check for image size too large
# poke max image size, and appropriate blocks_in_image value
echo "Test 1: Maximum size (1024 TB):"
poke_file "$TEST_IMG" "$ds_offset" "\x00\x00\xf0\xff\xff\xff\x03\x00"
poke_file "$TEST_IMG" "$bii_offset" "\xff\xff\xff\x3f"
_img_info
echo
echo "Test 2: Size too large (1024TB + 1)"
# This should be too large (-EINVAL):
poke_file "$TEST_IMG" "$ds_offset" "\x00\x00\xf1\xff\xff\xff\x03\x00"
_img_info
echo
echo "Test 3: Size valid (64M), but Blocks In Image too small (63)"
# This sets the size to 64M, but with a blocks_in_image size that is
# too small
poke_file "$TEST_IMG" "$ds_offset" "\x00\x00\x00\x04\x00\x00\x00\x00"
# For a 64M image, we would need a blocks_in_image value of at least 64,
# so 63 should be too small and give us -ENOTSUP
poke_file "$TEST_IMG" "$bii_offset" "\x3f\x00\x00\x00"
_img_info
echo
echo "Test 4: Size valid (64M), but Blocks In Image exceeds max allowed"
# Now check the bounds of blocks_in_image - 0x3fffffff should be the max
# value here, and we should get -ENOTSUP
poke_file "$TEST_IMG" "$bii_offset" "\x00\x00\x00\x40"
_img_info
# Finally, 1MB is the only block size supported. Verify that
# a value != 1MB results in error, both smaller and larger
echo
echo "Test 5: Valid Image: 64MB, Blocks In Image 64, Block Size 1MB"
poke_file "$TEST_IMG" "$bii_offset" "\x40\x00\x00\x00" # reset bii to valid
poke_file "$TEST_IMG" "$bs_offset" "\x00\x00\x10\x00" # valid
_img_info
echo
echo "Test 6: Block Size != 1MB; too small test (1MB - 1)"
poke_file "$TEST_IMG" "$bs_offset" "\xff\xff\x0f\x00" # invalid (too small)
_img_info
echo
echo "Test 7: Block Size != 1MB; too large test (1MB + 64KB)"
poke_file "$TEST_IMG" "$bs_offset" "\x00\x00\x11\x00" # invalid (too large)
_img_info
# success, all done
echo
echo "*** done"
rm -f $seq.full
status=0

33
tests/qemu-iotests/084.out Normal file
View file

@ -0,0 +1,33 @@
QA output created by 084
=== Testing image size bounds ===
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
Test 1: Maximum size (1024 TB):
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
virtual size: 1024T (1125899905794048 bytes)
cluster_size: 1048576
Test 2: Size too large (1024TB + 1)
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported VDI image size (size is 0x3fffffff10000, max supported is 0x3fffffff00000)
Test 3: Size valid (64M), but Blocks In Image too small (63)
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': unsupported VDI image (disk size 67108864, image bitmap has room for 66060288)
Test 4: Size valid (64M), but Blocks In Image exceeds max allowed
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': unsupported VDI image (too many blocks 1073741824, max is 1073741823)
Test 5: Valid Image: 64MB, Blocks In Image 64, Block Size 1MB
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
virtual size: 64M (67108864 bytes)
cluster_size: 1048576
Test 6: Block Size != 1MB; too small test (1MB - 1)
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': unsupported VDI image (block size 1048575 is not 1048576)
Test 7: Block Size != 1MB; too large test (1MB + 64KB)
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': unsupported VDI image (block size 1114112 is not 1048576)
*** done

64
tests/qemu-iotests/088 Executable file
View file

@ -0,0 +1,64 @@
#!/bin/bash
#
# vpc (VHD) format input validation tests
#
# Copyright (C) 2014 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=kwolf@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
here=`pwd`
tmp=/tmp/$$
status=1 # failure is the default!
_cleanup()
{
rm -f $TEST_IMG.snap
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
_supported_fmt vpc
_supported_proto generic
_supported_os Linux
offset_block_size=$((512 + 32))
echo
echo "== Invalid block size =="
_make_test_img 64M
poke_file "$TEST_IMG" "$offset_block_size" "\x00\x00\x00\x00"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_block_size" "\x00\x00\x00\x80"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
poke_file "$TEST_IMG" "$offset_block_size" "\x12\x34\x56\x78"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full
status=0

17
tests/qemu-iotests/088.out Normal file
View file

@ -0,0 +1,17 @@
QA output created by 088
== Invalid block size ==
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 0
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 0
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 128
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 128
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 305419896
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/t.vpc: Invalid block size 305419896
no file open, try 'help open'
*** done

21
tests/qemu-iotests/common
View file

@ -136,7 +136,10 @@ common options
check options
-raw test raw (default)
-bochs test bochs
-cow test cow
-cloop test cloop
-parallels test parallels
-qcow test qcow
-qcow2 test qcow2
-qed test qed
@ -173,11 +176,29 @@ testlist options
xpand=false
;;
-bochs)
IMGFMT=bochs
IMGFMT_GENERIC=false
xpand=false
;;
-cow)
IMGFMT=cow
xpand=false
;;
-cloop)
IMGFMT=cloop
IMGFMT_GENERIC=false
xpand=false
;;
-parallels)
IMGFMT=parallels
IMGFMT_GENERIC=false
xpand=false
;;
-qcow)
IMGFMT=qcow
xpand=false

3
tests/qemu-iotests/common.rc
View file

@ -364,6 +364,9 @@ _fail()
#
_supported_fmt()
{
# "generic" is suitable for most image formats. For some formats it doesn't
# work, however (most notably read-only formats), so they can opt out by
# setting IMGFMT_GENERIC to false.
for f; do
if [ "$f" = "$IMGFMT" -o "$f" = "generic" -a "$IMGFMT_GENERIC" = "true" ]; then
return

6
tests/qemu-iotests/group
View file

@ -81,11 +81,17 @@
072 rw auto quick
073 rw auto quick
074 rw auto quick
075 rw auto
076 auto
077 rw auto quick
078 rw auto
079 rw auto
080 rw auto
081 rw auto
082 rw auto quick
083 rw auto
084 img auto
085 rw auto
086 rw auto quick
087 rw auto
088 rw auto

BIN
tests/qemu-iotests/sample_images/empty.bochs.bz2 Normal file
View file

Binary file not shown.

BIN
tests/qemu-iotests/sample_images/fake.parallels.bz2 Normal file
View file

Binary file not shown.

BIN
tests/qemu-iotests/sample_images/simple-pattern.cloop.bz2 Normal file
View file

Binary file not shown.