mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-06 09:13:55 -06:00
b106ad9185
free_cluster_index is only correct if update_refcount() was called from an allocation function, and even there it's brittle because it's used to protect unfinished allocations which still have a refcount of 0 - if it moves in the wrong place, the unfinished allocation can be corrupted. So not using it any more seems to be a good idea. Instead, use the first requested cluster to do the calculations. Return -EAGAIN if unfinished allocations could become invalid and let the caller restart its search for some free clusters. The context of creating a snapsnot is one situation where update_refcount() is called outside of a cluster allocation. For this case, the change fixes a buffer overflow if a cluster is referenced in an L2 table that cannot be represented by an existing refcount block. (new_table[refcount_table_index] was out of bounds) [Bump the qemu-iotests 026 refblock_alloc.write leak count from 10 to 11. --Stefan] Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
73 lines
3 KiB
Text
73 lines
3 KiB
Text
QA output created by 080
|
|
|
|
== Huge header size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
|
|
no file open, try 'help open'
|
|
|
|
== Huge unknown header extension ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid backing file offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Header extension too large
|
|
no file open, try 'help open'
|
|
|
|
== Huge refcount table size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
|
|
no file open, try 'help open'
|
|
|
|
== Misaligned refcount table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
|
|
no file open, try 'help open'
|
|
|
|
== Huge refcount offset ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
|
|
no file open, try 'help open'
|
|
|
|
== Invalid snapshot table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
|
|
no file open, try 'help open'
|
|
|
|
== Hitting snapshot table size limit ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-img: Could not create snapshot 'test': -27 (File too large)
|
|
read 512/512 bytes at offset 0
|
|
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
|
== Invalid L1 table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
|
|
no file open, try 'help open'
|
|
|
|
== Invalid backing file size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Backing file name too long
|
|
no file open, try 'help open'
|
|
|
|
== Invalid L2 entry (huge physical offset) ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
wrote 512/512 bytes at offset 0
|
|
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
qemu-img: Could not create snapshot 'test': -27 (File too large)
|
|
qemu-img: Could not create snapshot 'test': -11 (Resource temporarily unavailable)
|
|
*** done
|