Re: [Qemu-block] [PATCH v5 02/10] raw: Check byte range uniformly

[Eric Blake]

On 05/22/2018 10:04 PM, Fam Zheng wrote:
> We don't verify the request range against s->size in the I/O callbacks
> except for raw_co_pwritev. This is wrong (especially for
> raw_co_pwrite_zeroes and raw_co_pdiscard), so fix them.

I'd also mention ...

> Signed-off-by: Fam Zheng <address@hidden>
> ---
>   block/raw-format.c | 64 +++++++++++++++++++++++++++++++++---------------------
>   1 file changed, 39 insertions(+), 25 deletions(-)

Should this cc: qemu-stable?

Do we have iotests coverage of this?

> diff --git a/block/raw-format.c b/block/raw-format.c
> index fe33693a2d..b69a0674b3 100644
> --- a/block/raw-format.c
> +++ b/block/raw-format.c
> @@ -167,16 +167,37 @@ static void raw_reopen_abort(BDRVReopenState *state)
>       state->opaque = NULL;
>   }
>   
> +/* Check and adjust the offset, against 'offset' and 'size' options. */
> +static inline int raw_adjust_offset(BlockDriverState *bs, uint64_t *offset,
> +                                    uint64_t bytes, bool is_write)
> +{
> +    BDRVRawState *s = bs->opaque;
> +
> +    if (s->has_size && (*offset > s->size || bytes > (s->size - *offset))) {
> +        /* There's not enough space for the write, or the read request is
> +         * out-of-range. Don't read/write anything to prevent leaking out of
> +         * the size specified in options. */
> +        return is_write ? -ENOSPC : -EINVAL;;
> +    }
> +
> +    if (*offset > INT64_MAX - s->offset) {
> +        return -EINVAL;

...that this change to a 63-bit check...

> @@ -186,23 +207,11 @@ static int coroutine_fn raw_co_pwritev(BlockDriverState 
> *bs, uint64_t offset,

> -    if (offset > UINT64_MAX - s->offset) {
> -        ret = -EINVAL;
> -        goto fail;
> -    }

...from a previous 64-bit check is intentional.

With improved commit message, and ideally with followup commits that add 
iotest coverage,

Reviewed-by: Eric Blake <address@hidden>

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org