[Qemu-devel] qcow2 snaphot loading

[Qemu-devel] qcow2 snaphot loading

[Clemens Kolbitsch]

Hi list,

I just upgraded from rev. 6600 to head and ran into problems loading snapshots 
(I also checked this with the 0.10.1 release on the homepage) because the old 
revision keeps crashing my Xserver from time to time.

I use an old qcow2 image as base for my snapshot file... when loading a 
snapshot, qemu displays

"Error -22 when loading VM state".

Since HW can change over revisions, I created a new snapshot file ("qemu-img 
create -b <base-file> -f qcow2 snap.qcow2") and retried creating a snapshot. 
When loading it, however, same result...

After stepping through the code, I got to this line (don't know if the bug is 
here, or if it is a bug at all, but maybe it helps finding the problem):


gdb --args ./i386-softmmu/qemu -hda snap.qcow2 -boot c -net nic -net 
tap,script=no,downscript=no,ifname=tap0 -m 512-kernel-kqemu -loadvm test

#0  bdrv_getlength (bs=0x1048010) at block.c:766
#1  0x0000000000492cdd in bdrv_check_byte_request (bs=0x1048010, 
offset=5368709120, size=32768) at block.c:531
#2  0x00000000004934d3 in bdrv_pread (bs=0x1048010, offset=5368709120, 
buf1=0x1301db0, count1=32768) at block.c:720
#3  0x00000000004b6945 in bdrv_get_buffer (opaque=0x107d9b0, buf=0x1301db0 "", 
pos=0, size=32768) at savevm.c:320
#4  0x00000000004b6b6d in qemu_fill_buffer (f=0x1301d70) at savevm.c:396
#5  0x00000000004b6f25 in qemu_get_byte (f=0x1301d70) at savevm.c:491
#4  0x00000000004b6b6d in qemu_fill_buffer (f=0x1301d70) at savevm.c:396
#5  0x00000000004b6f25 in qemu_get_byte (f=0x1301d70) at savevm.c:491
#6  0x00000000004b714d in qemu_get_be32 (f=0x1301d70) at savevm.c:563
#7  0x00000000004b7a24 in qemu_loadvm_state (f=0x1301d70) at savevm.c:856
#8  0x00000000004b8697 in do_loadvm (name=0x7fffbda105d1 "test") at 
savevm.c:1172
#9  0x000000000040fe81 in main (argc=14, argv=0x7fffbda0fbc8, 
envp=0x7fffbda0fc40) at src/qemu/qemu-0.10.1/vl.c:5718


then, back in block.c (bdrv_check_byte_request):

if (bs->growable)                                                                                                                                                                                                             
	return 0;                                                                                                                                                                                                                 
len = bdrv_getlength(bs);                                                                                                                                                                                                     
if ((offset + size) > len)                                                                                                                                                                                                    
	return -EIO;                                                                                                                                                                                                              

the code exits the function with the variables set to

(gdb) p/x offset
$1 = 0x140000000
(gdb) p/x size
$2 = 0x8000
(gdb) p/x len
$3 = 0x140000000

and snapshot loading exists with the error above. In case this is an error, 
could someone have a look? Maybe, there is just no backwards compatibility to 
old base images (which would be too bad, but at least I'd know the problem).

Thanks!
Clemens

Re: [Qemu-devel] qcow2 snaphot loading

[Riku Voipio]

On Mon, Mar 23, 2009 at 05:45:08PM +0100, Clemens Kolbitsch wrote:
> I just upgraded from rev. 6600 to head and ran into problems loading snapshots 
> (I also checked this with the 0.10.1 release on the homepage) because the old 
> revision keeps crashing my Xserver from time to time.

> "Error -22 when loading VM state".

..snip..

> then, back in block.c (bdrv_check_byte_request):

...snip...

> and snapshot loading exists with the error above. In case this is an error, 
> could someone have a look? Maybe, there is just no backwards compatibility to 
> old base images (which would be too bad, but at least I'd know the problem).

this was broken in svn commit 6677:

	Fix CVE-2008-0928 - insufficient block device address range checking (Anthony Liguori)

savevm writes to the block device after data...

Re: [Qemu-devel] qcow2 snaphot loading

[Clemens Kolbitsch]

On Tuesday 24 March 2009 09:16:08 Riku Voipio wrote:
> On Mon, Mar 23, 2009 at 05:45:08PM +0100, Clemens Kolbitsch wrote:
> > I just upgraded from rev. 6600 to head and ran into problems loading
> > snapshots (I also checked this with the 0.10.1 release on the homepage)
> > because the old revision keeps crashing my Xserver from time to time.
> >
> > "Error -22 when loading VM state".
>
> ..snip..
>
> > then, back in block.c (bdrv_check_byte_request):
>
> ...snip...
>
> > and snapshot loading exists with the error above. In case this is an
> > error, could someone have a look? Maybe, there is just no backwards
> > compatibility to old base images (which would be too bad, but at least
> > I'd know the problem).
>
> this was broken in svn commit 6677:
>
> 	Fix CVE-2008-0928 - insufficient block device address range checking
> (Anthony Liguori)
>
> savevm writes to the block device after data...

Thanks for the quick reply! But...

... ehem... the bug was never fixed up to the head (6883) revision (nor in the 
official version on the homepage) ?!

If so, is there a patch to it? If not... well, the bug still exists! :(