mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b15deac795
qemu/block
History
Jeff Cody b15deac795 block: vpc - prevent overflow if max_table_entries >= 0x40000000 
When we allocate the pagetable based on max_table_entries, we multiply
the max table entry value by 4 to accomodate a table of 32-bit integers.
However, max_table_entries is a uint32_t, and the VPC driver accepts
ranges for that entry over 0x40000000.  So during this allocation:

s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);

The size arg overflows, allocating significantly less memory than
expected.

Since qemu_try_blockalign() size argument is size_t, cast the
multiplication correctly to prevent overflow.

The value of "max_table_entries * 4" is used elsewhere in the code as
well, so store the correct value for use in all those cases.

We also check the Max Tables Entries value, to make sure that it is <
SIZE_MAX / 4, so we know the pagetable size will fit in size_t.

Cc: qemu-stable@nongnu.org
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-07-27 17:19:06 +02:00
..
accounting.c block: add accounting for merged requests 2015-02-06 17:24:21 +01:00
archipelago.c block: remove superfluous '\n' around error_report/error_setg 2015-03-10 08:15:33 +03:00
backup.c block: keep bitmap if incremental backup job is cancelled 2015-07-14 21:50:13 -04:00
blkdebug.c block: Move flag inheritance to bdrv_open_inherit() 2015-06-12 17:04:59 +02:00
blkverify.c block: Move flag inheritance to bdrv_open_inherit() 2015-06-12 17:04:59 +02:00
block-backend.c block-backend: Introduce blk_drain() 2015-06-23 15:06:16 +01:00
bochs.c block: Use g_new() & friends to avoid multiplying sizes 2014-08-20 11:51:28 +02:00
cloop.c cloop: Handle failure for potentially large allocations 2014-08-15 15:07:15 +02:00
commit.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
curl.c block/curl: Don't lose original error when a connection fails. 2015-07-14 21:50:13 -04:00
dmg.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
gluster.c block: don't convert file size to sector size 2014-09-12 15:43:06 +02:00
io.c block: update bdrv_drain_all()/bdrv_drain() comments 2015-07-07 10:31:08 +01:00
iscsi.c block/iscsi: restore compatiblity with libiscsi 1.9.0 2015-07-02 10:06:23 +01:00
linux-aio.c linux-aio: simplify removal of completed iocbs from the list 2014-12-12 16:57:55 +00:00
Makefile.objs block: convert quorum blockdrv to use crypto APIs 2015-07-08 13:11:01 +02:00
mirror.c mirror: Speed up bitmap initial scanning 2015-07-22 11:14:21 +01:00
nbd-client.c nbd: Set block size to BDRV_SECTOR_SIZE 2015-03-18 12:07:01 +01:00
nbd-client.h nbd: Set block size to BDRV_SECTOR_SIZE 2015-03-18 12:07:01 +01:00
nbd.c nbd: Fix nbd_establish_connection()'s return value 2015-03-18 12:05:38 +01:00
nfs.c block/nfs: limit maximum readahead size to 1MB 2015-07-02 10:06:23 +01:00
null.c block/null: Support reopen 2015-04-28 15:36:09 +02:00
parallels.c block/parallels: improve image writing performance further 2015-05-22 09:37:32 +01:00
qapi.c qerror: Finally unused, clean up 2015-06-22 18:20:40 +02:00
qcow2-cache.c qcow2: remove unnecessary check 2015-07-07 10:31:04 +01:00
qcow2-cluster.c block: convert qcow/qcow2 to use generic cipher API 2015-07-08 13:11:01 +02:00
qcow2-refcount.c qcow2: Handle EAGAIN returned from update_refcount 2015-07-02 09:20:18 +01:00
qcow2-snapshot.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qcow2.c block: convert qcow/qcow2 to use generic cipher API 2015-07-08 13:11:01 +02:00
qcow2.h block: convert qcow/qcow2 to use generic cipher API 2015-07-08 13:11:01 +02:00
qcow.c block: convert qcow/qcow2 to use generic cipher API 2015-07-08 13:11:01 +02:00
qed-check.c block: Use g_new() & friends to avoid multiplying sizes 2014-08-20 11:51:28 +02:00
qed-cluster.c
qed-gencb.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
qed-l2-cache.c qed: do not evict in-use L2 table cache entries 2012-03-12 15:14:06 +01:00
qed-table.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
qed.c qerror: Clean up QERR_ macros to expand into a single string 2015-06-22 18:20:40 +02:00
qed.h qed: Really remove unused field QEDAIOCB.finished 2015-02-06 17:24:21 +01:00
quorum.c block: convert quorum blockdrv to use crypto APIs 2015-07-08 13:11:01 +02:00
raw_bsd.c block: Add driver methods to probe blocksizes and geometry 2015-03-10 14:02:22 +01:00
raw-aio.h linux-aio: drop return code from laio_io_unplug and ioq_submit 2014-12-12 16:57:55 +00:00
raw-posix.c block/raw-posix: Don't think /dev/fd/<NN> is a floppy drive. 2015-07-07 14:27:14 +01:00
raw-win32.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
rbd.c rbd: fix ceph settings precedence 2015-07-14 17:15:23 +02:00
sheepdog.c sheepdog: fix resource leak with sd_snapshot_create 2015-05-08 14:11:10 +03:00
snapshot.c block: Use bdrv_drain to replace uncessary bdrv_drain_all 2015-07-07 14:27:14 +01:00
ssh.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
stream.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
throttle-groups.c throttle: Check current timers before updating any_timer_armed[] 2015-06-23 15:06:16 +01:00
vdi.c block: use bdrv_get_device_or_node_name() in error messages 2015-04-28 15:36:09 +02:00
vhdx-endian.c block: VHDX endian fixes 2014-08-15 15:07:14 +02:00
vhdx-log.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
vhdx.c block: use bdrv_get_device_or_node_name() in error messages 2015-04-28 15:36:09 +02:00
vhdx.h block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec 2014-12-12 15:42:22 +00:00
vmdk.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
vpc.c block: vpc - prevent overflow if max_table_entries >= 0x40000000 2015-07-27 17:19:06 +02:00
vvfat.c vvfat: add a label option 2015-06-23 15:06:17 +01:00
win32-aio.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
write-threshold.c block: Fix block-set-write-threshold not to use funky error class 2015-03-16 17:07:25 +01:00