Commit d1319b07 authored by Fam Zheng's avatar Fam Zheng Committed by Stefan Hajnoczi
Browse files

vmdk: Fix integer overflow in offset calculation 



This fixes the bug introduced by commit c6ac36e1 (vmdk: Optimize cluster
allocation).

$ ~/build/master/qemu-io /stor/vm/arch.vmdk -c 'write 2G 1k'
write failed: Invalid argument

Reported-by: default avatarMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarFam Zheng <famz@redhat.com>
Message-id: 1411437381-11234-1-git-send-email-famz@redhat.com
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent fbf28a43

block/vmdk.c

+1 −1
Original line number Diff line number Diff line
@@ -1113,7 +1113,7 @@ static int get_cluster_offset(BlockDriverState *bs, 
    uint32_t min_count, *l2_table;

    bool zeroed = false;

    int64_t ret;

    int32_t cluster_sector;

    int64_t cluster_sector;



    if (m_data) {

        m_data->valid = 0;

tests/qemu-iotests/105

0 → 100755
+70 −0
Original line number Diff line number Diff line 
#!/bin/bash

#

# Create, read, write big image

#

# Copyright (C) 2014 Red Hat, Inc.

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

#



# creator

owner=famz@redhat.com



seq=`basename $0`

echo "QA output created by $seq"



here=`pwd`

tmp=/tmp/$$

status=1	# failure is the default!



_cleanup()

{

	_cleanup_test_img

}

trap "_cleanup; exit \$status" 0 1 2 3 15



# get standard environment, filters and checks

. ./common.rc

. ./common.filter



_supported_fmt qcow2 vmdk vhdx qed

_supported_proto generic

_supported_os Linux

_unsupported_imgopts "subformat=twoGbMaxExtentFlat" \

                     "subformat=twoGbMaxExtentSparse"



echo

echo "creating large image"

_make_test_img 16T



echo

echo "small read"

$QEMU_IO -c "read 1024 4096" "$TEST_IMG" | _filter_qemu_io



echo

echo "small write"

$QEMU_IO -c "write 8192 4096" "$TEST_IMG" | _filter_qemu_io



echo

echo "small read at high offset"

$QEMU_IO -c "read 14T 4096" "$TEST_IMG" | _filter_qemu_io



echo

echo "small write at high offset"

$QEMU_IO -c "write 14T 4096" "$TEST_IMG" | _filter_qemu_io



# success, all done

echo "*** done"

rm -f $seq.full

status=0

tests/qemu-iotests/105.out

0 → 100644
+21 −0
Original line number Diff line number Diff line 
QA output created by 105



creating large image

Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=17592186044416



small read

read 4096/4096 bytes at offset 1024

4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)



small write

wrote 4096/4096 bytes at offset 8192

4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)



small read at high offset

read 4096/4096 bytes at offset 15393162788864

4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)



small write at high offset

wrote 4096/4096 bytes at offset 15393162788864

4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

*** done

tests/qemu-iotests/group

+1 −0
Original line number Diff line number Diff line
@@ -105,3 +105,4 @@ 
101 rw auto quick

103 rw auto quick

104 rw auto

105 rw auto quick