From patchwork Mon Nov 28 16:18:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 128005 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 4A4B7B6F84 for ; Tue, 29 Nov 2011 03:18:57 +1100 (EST) Received: from localhost ([::1]:47528 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RV3uo-0002D0-3o for incoming@patchwork.ozlabs.org; Mon, 28 Nov 2011 11:18:46 -0500 Received: from eggs.gnu.org ([140.186.70.92]:60227) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RV3ud-0002Cc-2C for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RV3uX-0004P1-9F for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:35 -0500 Received: from e06smtp16.uk.ibm.com ([195.75.94.112]:42737) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RV3uW-0004Oa-Uw for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:29 -0500 Received: from /spool/local by e06smtp16.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 28 Nov 2011 16:18:27 -0000 Received: from d06nrmr1806.portsmouth.uk.ibm.com ([9.149.39.193]) by e06smtp16.uk.ibm.com ([192.168.101.146]) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 28 Nov 2011 16:18:26 -0000 Received: from d06av03.portsmouth.uk.ibm.com (d06av03.portsmouth.uk.ibm.com [9.149.37.213]) by d06nrmr1806.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pASGIP7U2666670 for ; Mon, 28 Nov 2011 16:18:25 GMT Received: from d06av03.portsmouth.uk.ibm.com (localhost.localdomain [127.0.0.1]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pASGIPdM025643 for ; Mon, 28 Nov 2011 09:18:25 -0700 Received: from localhost (stefanha-thinkpad.manchester-maybrook.uk.ibm.com [9.174.219.31]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id pASGIPqa025634; Mon, 28 Nov 2011 09:18:25 -0700 From: Stefan Hajnoczi To: Date: Mon, 28 Nov 2011 16:18:20 +0000 Message-Id: <1322497100-24167-1-git-send-email-stefanha@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.7.3 x-cbid: 11112816-3548-0000-0000-0000003BA3C8 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 195.75.94.112 Cc: Kevin Wolf , Stefan Hajnoczi Subject: [Qemu-devel] [PATCH] qed: limit to image size in qed_find_cluster() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Callers of bdrv_is_allocated() may go beyond the end of the image. For general robustness we should limit to the end of the image so that callers don't end up using out-of-range sector counts and receive -EIO. This fix will allow the image streaming to terminate successfully. Signed-off-by: Stefan Hajnoczi --- block/qed-cluster.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/block/qed-cluster.c b/block/qed-cluster.c index f64b2af..4632b32 100644 --- a/block/qed-cluster.c +++ b/block/qed-cluster.c @@ -142,6 +142,9 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos, */ len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos); + /* Limit length to image size */ + len = MIN(len, s->header.image_size - pos); + l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)]; if (qed_offset_is_unalloc_cluster(l2_offset)) { cb(opaque, QED_CLUSTER_L1, 0, len);