From patchwork Mon Oct 15 12:44:16 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 191556 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 9C9C82C00A6 for ; Mon, 15 Oct 2012 23:45:28 +1100 (EST) Received: from localhost ([::1]:59179 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TNk2w-0008Pb-PH for incoming@patchwork.ozlabs.org; Mon, 15 Oct 2012 08:45:26 -0400 Received: from eggs.gnu.org ([208.118.235.92]:49865) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TNk2X-0007ro-Gr for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:45:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TNk2N-00020n-Sf for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:45:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60542) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TNk2N-00020h-Iu for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:44:51 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9FCimM4023449 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 15 Oct 2012 08:44:48 -0400 Received: from localhost (ovpn-112-27.ams2.redhat.com [10.36.112.27]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9FCikug031002; Mon, 15 Oct 2012 08:44:47 -0400 From: Stefan Hajnoczi To: Date: Mon, 15 Oct 2012 14:44:16 +0200 Message-Id: <1350305057-6287-3-git-send-email-stefanha@redhat.com> In-Reply-To: <1350305057-6287-1-git-send-email-stefanha@redhat.com> References: <1350305057-6287-1-git-send-email-stefanha@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.132.183.28 Cc: Kevin Wolf , kashyap.cv@gmail.com, =?UTF-8?q?Beno=C3=AEt=20Canet?= , Stefan Hajnoczi Subject: [Qemu-devel] [PATCH v2 2/3] qemu-img: Detect backing file chain infinite loops X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org A malicious or corruption image can contain an infinite loop of backing files. The qemu-img info --backing-chain command must not hang when such files are encountered. Signed-off-by: Stefan Hajnoczi --- qemu-img.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/qemu-img.c b/qemu-img.c index c717f3e..60a5cc8 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -1259,6 +1259,11 @@ typedef enum OutputFormat { OFORMAT_HUMAN, } OutputFormat; +static gboolean str_equal_func(gconstpointer a, gconstpointer b) +{ + return strcmp(a, b) == 0; +} + static int img_info(int argc, char **argv) { int c; @@ -1268,6 +1273,7 @@ static int img_info(int argc, char **argv) char *filename, *fmt; BlockDriverState *bs; ImageInfo *info; + GHashTable *filenames; fmt = NULL; output = NULL; @@ -1306,6 +1312,9 @@ static int img_info(int argc, char **argv) } filename = g_strdup(argv[optind++]); + filenames = g_hash_table_new_full(g_str_hash, str_equal_func, + g_free, NULL); + if (output && !strcmp(output, "json")) { output_format = OFORMAT_JSON; } else if (output && !strcmp(output, "human")) { @@ -1320,6 +1329,12 @@ static int img_info(int argc, char **argv) } do { + if (g_hash_table_lookup_extended(filenames, filename, NULL, NULL)) { + error_report("Aborting due to backing file chain infinite loop."); + goto err; + } + g_hash_table_insert(filenames, g_strdup(filename), NULL); + bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_NO_BACKING, false); if (!bs) { @@ -1376,11 +1391,13 @@ static int img_info(int argc, char **argv) if (chain && output_format == OFORMAT_JSON) { printf("]\n"); } + g_hash_table_destroy(filenames); return 0; err: g_free(filename); g_free(fmt); + g_hash_table_destroy(filenames); return 1; }