mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7452162ade
qemu/tests/qemu-iotests/061
Kevin Wolf bd385a5298 qcow2: Don't open data_file with BDRV_O_NO_IO 
One use case for 'qemu-img info' is verifying that untrusted images
don't reference an unwanted external file, be it as a backing file or an
external data file. To make sure that calling 'qemu-img info' can't
already have undesired side effects with a malicious image, just don't
open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
I/O, we don't need to have it open.

This changes the output of iotests case 061, which used 'qemu-img info'
to show that opening an image with an invalid data file fails. After
this patch, it succeeds. Replace this part of the test with a qemu-io
call, but keep the final 'qemu-img info' to show that the invalid data
file is correctly displayed in the output.

Fixes: CVE-2024-4467
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
2024-07-02 18:09:51 +02:00

360 lines
12 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
# group: rw auto
#
# Test case for image option amendment in qcow2.
#
# Copyright (C) 2013 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# creator
owner=hreitz@redhat.com
seq=`basename $0`
echo "QA output created by $seq"
status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
_rm_test_img "$TEST_IMG.data"
}
trap "_cleanup; exit \$status" 0 1 2 3 15
# get standard environment, filters and checks
. ./common.rc
. ./common.filter
# This tests qcow2-specific low-level functionality
_supported_fmt qcow2
_supported_proto file
_supported_os Linux
# Conversion between different compat versions can only really work
# with refcount_bits=16;
# we have explicit tests for data_file here, but the whole test does
# not work with it;
# we have explicit tests for various cluster sizes, the remaining tests
# require the default 64k cluster
# we don't have explicit tests for zstd qcow2 compression type, as zstd may be
# not compiled in. And we can't create compat images with compression type
# extension
_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file \
cluster_size compression_type
echo
echo "=== Testing version downgrade with zero expansion ==="
echo
_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M
$QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
_qcow2_dump_header
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_qcow2_dump_header
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing version downgrade with zero expansion and 4K cache entries ==="
echo
_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M
$QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IO -c "write -z 32M 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IO -c map "$TEST_IMG" | _filter_qemu_io
_qcow2_dump_header
$QEMU_IMG amend -o "compat=0.10" --image-opts \
driver=qcow2,file.filename=$TEST_IMG,l2-cache-entry-size=4096
_qcow2_dump_header
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IO -c "read -P 0 32M 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IO -c map "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing dirty version downgrade ==="
echo
_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M
_NO_VALGRIND \
$QEMU_IO -c "write -P 0x2a 0 128k" -c flush \
-c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 | _filter_qemu_io
_qcow2_dump_header
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_qcow2_dump_header
$QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing version downgrade with unknown compat/autoclear flags ==="
echo
_make_test_img -o "compat=1.1" 64M
$PYTHON qcow2.py "$TEST_IMG" set-feature-bit compatible 42
$PYTHON qcow2.py "$TEST_IMG" set-feature-bit autoclear 42
_qcow2_dump_header
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_qcow2_dump_header
_check_test_img
echo
echo "=== Testing version upgrade and resize ==="
echo
_make_test_img -o "compat=0.10" 64M
$QEMU_IO -c "write -P 0x2a 42M 64k" "$TEST_IMG" | _filter_qemu_io
_qcow2_dump_header
$QEMU_IMG amend -o "compat=1.1,lazy_refcounts=on,size=128M" "$TEST_IMG"
_qcow2_dump_header
$QEMU_IO -c "read -P 0x2a 42M 64k" "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing resize with snapshots ==="
echo
_make_test_img -o "compat=0.10" 32M
$QEMU_IO -c "write -P 0x2a 24M 64k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IMG resize "$TEST_IMG" 64M &&
echo "unexpected pass"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
$QEMU_IMG amend -o "compat=1.1,size=128M" "$TEST_IMG" ||
echo "unexpected fail"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
$QEMU_IMG snapshot -c bar "$TEST_IMG"
$QEMU_IMG resize --shrink "$TEST_IMG" 64M ||
echo "unexpected fail"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
$QEMU_IMG amend -o "compat=0.10,size=32M" "$TEST_IMG" &&
echo "unexpected pass"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
$QEMU_IMG snapshot -a bar "$TEST_IMG" ||
echo "unexpected fail"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
$QEMU_IMG snapshot -d bar "$TEST_IMG"
$QEMU_IMG amend -o "compat=0.10,size=32M" "$TEST_IMG" ||
echo "unexpected fail"
_qcow2_dump_header | grep '^\(version\|size\|nb_snap\)'
_check_test_img
echo
echo "=== Testing dirty lazy_refcounts=off ==="
echo
_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M
_NO_VALGRIND \
$QEMU_IO -c "write -P 0x2a 0 128k" -c flush \
-c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 | _filter_qemu_io
_qcow2_dump_header
$QEMU_IMG amend -o "lazy_refcounts=off" "$TEST_IMG"
_qcow2_dump_header
$QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing backing file ==="
echo
_make_test_img -o "compat=1.1" 64M
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" \
"$TEST_IMG" && echo "unexpected pass"
$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F qcow2 "$TEST_IMG"
$QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" "$TEST_IMG"
$QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
_check_test_img
echo
echo "=== Testing invalid configurations ==="
echo
_make_test_img -o "compat=0.10" 64M
$QEMU_IMG amend -o "lazy_refcounts=on" "$TEST_IMG"
$QEMU_IMG amend -o "compat=1.1" "$TEST_IMG" # actually valid
$QEMU_IMG amend -o "compat=0.10,lazy_refcounts=on" "$TEST_IMG"
$QEMU_IMG amend -o "compat=0.42" "$TEST_IMG"
$QEMU_IMG amend -o "foo=bar" "$TEST_IMG"
$QEMU_IMG amend -o "cluster_size=1k" "$TEST_IMG"
$QEMU_IMG amend -o "encryption=on" "$TEST_IMG"
$QEMU_IMG amend -o "preallocation=on" "$TEST_IMG"
echo
echo "=== Testing correct handling of unset value ==="
echo
_make_test_img -o "compat=1.1,cluster_size=1k" 64M
echo "Should work:"
$QEMU_IMG amend -o "lazy_refcounts=on" "$TEST_IMG"
echo "Should not work:" # Just to know which of these tests actually fails
$QEMU_IMG amend -o "cluster_size=64k" "$TEST_IMG"
echo
echo "=== Testing zero expansion on inactive clusters ==="
echo
_make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -a foo "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing zero expansion on shared L2 table ==="
echo
_make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -a foo "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing zero expansion on backed image ==="
echo
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
$QEMU_IO -c "read -P 0x2a 0 128k" -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 64k" -c "read -P 0x2a 64k 64k" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing zero expansion on backed inactive clusters ==="
echo
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
$QEMU_IO -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IO -c "write -P 0x42 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0x42 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -a foo "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 64k" -c "read -P 0x2a 64k 64k" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing zero expansion on backed image with shared L2 table ==="
echo
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
$QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -a foo "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing preallocated zero expansion on full image ==="
echo
TEST_IMG="$TEST_IMG" _make_test_img -o "compat=1.1" 64M
$QEMU_IO -c "write -P 0x2a 0 64M" "$TEST_IMG" -c "write -z 0 64M" | _filter_qemu_io
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_check_test_img
$QEMU_IO -c "read -P 0 0 64M" "$TEST_IMG" | _filter_qemu_io
echo
echo "=== Testing progress report without snapshot ==="
echo
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G
_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 4G
$QEMU_IO -c "write -z 0 64k" \
-c "write -z 1G 64k" \
-c "write -z 2G 64k" \
-c "write -z 3G 64k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG amend -p -o "compat=0.10" "$TEST_IMG"
_check_test_img
echo
echo "=== Testing progress report with snapshot ==="
echo
TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G
_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 4G
$QEMU_IO -c "write -z 0 64k" \
-c "write -z 1G 64k" \
-c "write -z 2G 64k" \
-c "write -z 3G 64k" "$TEST_IMG" | _filter_qemu_io
$QEMU_IMG snapshot -c foo "$TEST_IMG"
$QEMU_IMG amend -p -o "compat=0.10" "$TEST_IMG"
_check_test_img
echo
echo "=== Testing version downgrade with external data file ==="
echo
_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
_img_info --format-specific
_check_test_img
echo
echo "=== Testing version downgrade with extended L2 entries ==="
echo
_make_test_img -o "compat=1.1,extended_l2=on" 64M
$QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
echo
echo "=== Try changing the external data file ==="
echo
_make_test_img -o "compat=1.1" 64M
$QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
echo
_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M
$QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
echo
$QEMU_IMG amend -o "data_file=" --image-opts "data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG"
$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
echo
echo "=== Clearing and setting data-file-raw ==="
echo
_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data,data_file_raw=on" 64M
$QEMU_IMG amend -o "data_file_raw=on" "$TEST_IMG"
_img_info --format-specific
_check_test_img
$QEMU_IMG amend -o "data_file_raw=off" "$TEST_IMG"
_img_info --format-specific
_check_test_img
$QEMU_IMG amend -o "data_file_raw=on" "$TEST_IMG"
_img_info --format-specific
_check_test_img
# success, all done
echo "*** done"
rm -f $seq.full
status=0
Reference in New Issue View Git Blame Copy Permalink