From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39735) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X35pY-0000cz-G8 for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X35pQ-0005wh-Su for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41861) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X35pQ-0005wT-KY for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:12 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s64FtBZx007233 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 4 Jul 2014 11:55:12 -0400 From: Kevin Wolf Date: Fri, 4 Jul 2014 17:55:03 +0200 Message-Id: <1404489305-8750-3-git-send-email-kwolf@redhat.com> In-Reply-To: <1404489305-8750-1-git-send-email-kwolf@redhat.com> References: <1404489305-8750-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 2/4] qcow2: Make qiov match request size until backing file EOF List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, stefanha@redhat.com If a qcow2 image has a shorter backing file and a read request to unallocated clusters goes across EOF of the backing file, the backing file sees a shortened request and the rest is filled with zeros. However, the original too long qiov was used with the shortened request. This patch makes the qiov size match the request size, avoiding a potential buffer overflow in raw-posix. Signed-off-by: Kevin Wolf --- block/qcow2.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/block/qcow2.c b/block/qcow2.c index 67e55c9..b0faa69 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -1020,11 +1020,20 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num, n1 = qcow2_backing_read1(bs->backing_hd, &hd_qiov, sector_num, cur_nr_sectors); if (n1 > 0) { + QEMUIOVector local_qiov; + + qemu_iovec_init(&local_qiov, hd_qiov.niov); + qemu_iovec_concat(&local_qiov, &hd_qiov, 0, + n1 * BDRV_SECTOR_SIZE); + BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO); qemu_co_mutex_unlock(&s->lock); ret = bdrv_co_readv(bs->backing_hd, sector_num, - n1, &hd_qiov); + n1, &local_qiov); qemu_co_mutex_lock(&s->lock); + + qemu_iovec_destroy(&local_qiov); + if (ret < 0) { goto fail; } -- 1.8.3.1