dmg: prevent chunk buffer overflow (CVE-2014-0145)
[qemu.git] / qemu-nbd.c
blob899e67cfd711db3e9a6666ef7c558ce7554a31c6
1 /*
2 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
4 * Network Block Device
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; under version 2 of the License.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 #include "qemu-common.h"
20 #include "block/block.h"
21 #include "block/nbd.h"
22 #include "qemu/main-loop.h"
23 #include "qemu/sockets.h"
24 #include "qemu/error-report.h"
25 #include "block/snapshot.h"
27 #include <stdarg.h>
28 #include <stdio.h>
29 #include <getopt.h>
30 #include <err.h>
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <netinet/in.h>
34 #include <netinet/tcp.h>
35 #include <arpa/inet.h>
36 #include <signal.h>
37 #include <libgen.h>
38 #include <pthread.h>
40 #define SOCKET_PATH "/var/lock/qemu-nbd-%s"
41 #define QEMU_NBD_OPT_CACHE 1
42 #define QEMU_NBD_OPT_AIO 2
43 #define QEMU_NBD_OPT_DISCARD 3
45 static NBDExport *exp;
46 static int verbose;
47 static char *srcpath;
48 static char *sockpath;
49 static int persistent = 0;
50 static enum { RUNNING, TERMINATE, TERMINATING, TERMINATED } state;
51 static int shared = 1;
52 static int nb_fds;
54 static void usage(const char *name)
56 (printf) (
57 "Usage: %s [OPTIONS] FILE\n"
58 "QEMU Disk Network Block Device Server\n"
59 "\n"
60 " -h, --help display this help and exit\n"
61 " -V, --version output version information and exit\n"
62 "\n"
63 "Connection properties:\n"
64 " -p, --port=PORT port to listen on (default `%d')\n"
65 " -b, --bind=IFACE interface to bind to (default `0.0.0.0')\n"
66 " -k, --socket=PATH path to the unix socket\n"
67 " (default '"SOCKET_PATH"')\n"
68 " -e, --shared=NUM device can be shared by NUM clients (default '1')\n"
69 " -t, --persistent don't exit on the last connection\n"
70 " -v, --verbose display extra debugging information\n"
71 "\n"
72 "Exposing part of the image:\n"
73 " -o, --offset=OFFSET offset into the image\n"
74 " -P, --partition=NUM only expose partition NUM\n"
75 "\n"
76 #ifdef __linux__
77 "Kernel NBD client support:\n"
78 " -c, --connect=DEV connect FILE to the local NBD device DEV\n"
79 " -d, --disconnect disconnect the specified device\n"
80 "\n"
81 #endif
82 "\n"
83 "Block device options:\n"
84 " -f, --format=FORMAT set image format (raw, qcow2, ...)\n"
85 " -r, --read-only export read-only\n"
86 " -s, --snapshot use FILE as an external snapshot, create a temporary\n"
87 " file with backing_file=FILE, redirect the write to\n"
88 " the temporary one\n"
89 " -l, --load-snapshot=SNAPSHOT_PARAM\n"
90 " load an internal snapshot inside FILE and export it\n"
91 " as an read-only device, SNAPSHOT_PARAM format is\n"
92 " 'snapshot.id=[ID],snapshot.name=[NAME]', or\n"
93 " '[ID_OR_NAME]'\n"
94 " -n, --nocache disable host cache\n"
95 " --cache=MODE set cache mode (none, writeback, ...)\n"
96 #ifdef CONFIG_LINUX_AIO
97 " --aio=MODE set AIO mode (native or threads)\n"
98 #endif
99 "\n"
100 "Report bugs to <qemu-devel@nongnu.org>\n"
101 , name, NBD_DEFAULT_PORT, "DEVICE");
104 static void version(const char *name)
106 printf(
107 "%s version 0.0.1\n"
108 "Written by Anthony Liguori.\n"
109 "\n"
110 "Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>.\n"
111 "This is free software; see the source for copying conditions. There is NO\n"
112 "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n"
113 , name);
116 struct partition_record
118 uint8_t bootable;
119 uint8_t start_head;
120 uint32_t start_cylinder;
121 uint8_t start_sector;
122 uint8_t system;
123 uint8_t end_head;
124 uint8_t end_cylinder;
125 uint8_t end_sector;
126 uint32_t start_sector_abs;
127 uint32_t nb_sectors_abs;
130 static void read_partition(uint8_t *p, struct partition_record *r)
132 r->bootable = p[0];
133 r->start_head = p[1];
134 r->start_cylinder = p[3] | ((p[2] << 2) & 0x0300);
135 r->start_sector = p[2] & 0x3f;
136 r->system = p[4];
137 r->end_head = p[5];
138 r->end_cylinder = p[7] | ((p[6] << 2) & 0x300);
139 r->end_sector = p[6] & 0x3f;
140 r->start_sector_abs = p[8] | p[9] << 8 | p[10] << 16 | p[11] << 24;
141 r->nb_sectors_abs = p[12] | p[13] << 8 | p[14] << 16 | p[15] << 24;
144 static int find_partition(BlockDriverState *bs, int partition,
145 off_t *offset, off_t *size)
147 struct partition_record mbr[4];
148 uint8_t data[512];
149 int i;
150 int ext_partnum = 4;
151 int ret;
153 if ((ret = bdrv_read(bs, 0, data, 1)) < 0) {
154 errno = -ret;
155 err(EXIT_FAILURE, "error while reading");
158 if (data[510] != 0x55 || data[511] != 0xaa) {
159 return -EINVAL;
162 for (i = 0; i < 4; i++) {
163 read_partition(&data[446 + 16 * i], &mbr[i]);
165 if (!mbr[i].nb_sectors_abs)
166 continue;
168 if (mbr[i].system == 0xF || mbr[i].system == 0x5) {
169 struct partition_record ext[4];
170 uint8_t data1[512];
171 int j;
173 if ((ret = bdrv_read(bs, mbr[i].start_sector_abs, data1, 1)) < 0) {
174 errno = -ret;
175 err(EXIT_FAILURE, "error while reading");
178 for (j = 0; j < 4; j++) {
179 read_partition(&data1[446 + 16 * j], &ext[j]);
180 if (!ext[j].nb_sectors_abs)
181 continue;
183 if ((ext_partnum + j + 1) == partition) {
184 *offset = (uint64_t)ext[j].start_sector_abs << 9;
185 *size = (uint64_t)ext[j].nb_sectors_abs << 9;
186 return 0;
189 ext_partnum += 4;
190 } else if ((i + 1) == partition) {
191 *offset = (uint64_t)mbr[i].start_sector_abs << 9;
192 *size = (uint64_t)mbr[i].nb_sectors_abs << 9;
193 return 0;
197 return -ENOENT;
200 static void termsig_handler(int signum)
202 state = TERMINATE;
203 qemu_notify_event();
206 static void combine_addr(char *buf, size_t len, const char* address,
207 uint16_t port)
209 /* If the address-part contains a colon, it's an IPv6 IP so needs [] */
210 if (strstr(address, ":")) {
211 snprintf(buf, len, "[%s]:%u", address, port);
212 } else {
213 snprintf(buf, len, "%s:%u", address, port);
217 static int tcp_socket_incoming(const char *address, uint16_t port)
219 char address_and_port[128];
220 Error *local_err = NULL;
222 combine_addr(address_and_port, 128, address, port);
223 int fd = inet_listen(address_and_port, NULL, 0, SOCK_STREAM, 0, &local_err);
225 if (local_err != NULL) {
226 qerror_report_err(local_err);
227 error_free(local_err);
229 return fd;
232 static int unix_socket_incoming(const char *path)
234 Error *local_err = NULL;
235 int fd = unix_listen(path, NULL, 0, &local_err);
237 if (local_err != NULL) {
238 qerror_report_err(local_err);
239 error_free(local_err);
241 return fd;
244 static int unix_socket_outgoing(const char *path)
246 Error *local_err = NULL;
247 int fd = unix_connect(path, &local_err);
249 if (local_err != NULL) {
250 qerror_report_err(local_err);
251 error_free(local_err);
253 return fd;
256 static void *show_parts(void *arg)
258 char *device = arg;
259 int nbd;
261 /* linux just needs an open() to trigger
262 * the partition table update
263 * but remember to load the module with max_part != 0 :
264 * modprobe nbd max_part=63
266 nbd = open(device, O_RDWR);
267 if (nbd >= 0) {
268 close(nbd);
270 return NULL;
273 static void *nbd_client_thread(void *arg)
275 char *device = arg;
276 off_t size;
277 size_t blocksize;
278 uint32_t nbdflags;
279 int fd, sock;
280 int ret;
281 pthread_t show_parts_thread;
283 sock = unix_socket_outgoing(sockpath);
284 if (sock < 0) {
285 goto out;
288 ret = nbd_receive_negotiate(sock, NULL, &nbdflags,
289 &size, &blocksize);
290 if (ret < 0) {
291 goto out_socket;
294 fd = open(device, O_RDWR);
295 if (fd < 0) {
296 /* Linux-only, we can use %m in printf. */
297 fprintf(stderr, "Failed to open %s: %m", device);
298 goto out_socket;
301 ret = nbd_init(fd, sock, nbdflags, size, blocksize);
302 if (ret < 0) {
303 goto out_fd;
306 /* update partition table */
307 pthread_create(&show_parts_thread, NULL, show_parts, device);
309 if (verbose) {
310 fprintf(stderr, "NBD device %s is now connected to %s\n",
311 device, srcpath);
312 } else {
313 /* Close stderr so that the qemu-nbd process exits. */
314 dup2(STDOUT_FILENO, STDERR_FILENO);
317 ret = nbd_client(fd);
318 if (ret) {
319 goto out_fd;
321 close(fd);
322 kill(getpid(), SIGTERM);
323 return (void *) EXIT_SUCCESS;
325 out_fd:
326 close(fd);
327 out_socket:
328 closesocket(sock);
329 out:
330 kill(getpid(), SIGTERM);
331 return (void *) EXIT_FAILURE;
334 static int nbd_can_accept(void *opaque)
336 return nb_fds < shared;
339 static void nbd_export_closed(NBDExport *exp)
341 assert(state == TERMINATING);
342 state = TERMINATED;
345 static void nbd_client_closed(NBDClient *client)
347 nb_fds--;
348 if (nb_fds == 0 && !persistent && state == RUNNING) {
349 state = TERMINATE;
351 qemu_notify_event();
352 nbd_client_put(client);
355 static void nbd_accept(void *opaque)
357 int server_fd = (uintptr_t) opaque;
358 struct sockaddr_in addr;
359 socklen_t addr_len = sizeof(addr);
361 int fd = accept(server_fd, (struct sockaddr *)&addr, &addr_len);
362 if (fd < 0) {
363 perror("accept");
364 return;
367 if (state >= TERMINATE) {
368 close(fd);
369 return;
372 if (fd >= 0 && nbd_client_new(exp, fd, nbd_client_closed)) {
373 nb_fds++;
377 int main(int argc, char **argv)
379 BlockDriverState *bs;
380 BlockDriver *drv;
381 off_t dev_offset = 0;
382 uint32_t nbdflags = 0;
383 bool disconnect = false;
384 const char *bindto = "0.0.0.0";
385 char *device = NULL;
386 int port = NBD_DEFAULT_PORT;
387 off_t fd_size;
388 QemuOpts *sn_opts = NULL;
389 const char *sn_id_or_name = NULL;
390 const char *sopt = "hVb:o:p:rsnP:c:dvk:e:f:tl:";
391 struct option lopt[] = {
392 { "help", 0, NULL, 'h' },
393 { "version", 0, NULL, 'V' },
394 { "bind", 1, NULL, 'b' },
395 { "port", 1, NULL, 'p' },
396 { "socket", 1, NULL, 'k' },
397 { "offset", 1, NULL, 'o' },
398 { "read-only", 0, NULL, 'r' },
399 { "partition", 1, NULL, 'P' },
400 { "connect", 1, NULL, 'c' },
401 { "disconnect", 0, NULL, 'd' },
402 { "snapshot", 0, NULL, 's' },
403 { "load-snapshot", 1, NULL, 'l' },
404 { "nocache", 0, NULL, 'n' },
405 { "cache", 1, NULL, QEMU_NBD_OPT_CACHE },
406 #ifdef CONFIG_LINUX_AIO
407 { "aio", 1, NULL, QEMU_NBD_OPT_AIO },
408 #endif
409 { "discard", 1, NULL, QEMU_NBD_OPT_DISCARD },
410 { "shared", 1, NULL, 'e' },
411 { "format", 1, NULL, 'f' },
412 { "persistent", 0, NULL, 't' },
413 { "verbose", 0, NULL, 'v' },
414 { NULL, 0, NULL, 0 }
416 int ch;
417 int opt_ind = 0;
418 int li;
419 char *end;
420 int flags = BDRV_O_RDWR;
421 int partition = -1;
422 int ret;
423 int fd;
424 bool seen_cache = false;
425 bool seen_discard = false;
426 #ifdef CONFIG_LINUX_AIO
427 bool seen_aio = false;
428 #endif
429 pthread_t client_thread;
430 const char *fmt = NULL;
431 Error *local_err = NULL;
433 /* The client thread uses SIGTERM to interrupt the server. A signal
434 * handler ensures that "qemu-nbd -v -c" exits with a nice status code.
436 struct sigaction sa_sigterm;
437 memset(&sa_sigterm, 0, sizeof(sa_sigterm));
438 sa_sigterm.sa_handler = termsig_handler;
439 sigaction(SIGTERM, &sa_sigterm, NULL);
440 qemu_init_exec_dir(argv[0]);
442 while ((ch = getopt_long(argc, argv, sopt, lopt, &opt_ind)) != -1) {
443 switch (ch) {
444 case 's':
445 flags |= BDRV_O_SNAPSHOT;
446 break;
447 case 'n':
448 optarg = (char *) "none";
449 /* fallthrough */
450 case QEMU_NBD_OPT_CACHE:
451 if (seen_cache) {
452 errx(EXIT_FAILURE, "-n and --cache can only be specified once");
454 seen_cache = true;
455 if (bdrv_parse_cache_flags(optarg, &flags) == -1) {
456 errx(EXIT_FAILURE, "Invalid cache mode `%s'", optarg);
458 break;
459 #ifdef CONFIG_LINUX_AIO
460 case QEMU_NBD_OPT_AIO:
461 if (seen_aio) {
462 errx(EXIT_FAILURE, "--aio can only be specified once");
464 seen_aio = true;
465 if (!strcmp(optarg, "native")) {
466 flags |= BDRV_O_NATIVE_AIO;
467 } else if (!strcmp(optarg, "threads")) {
468 /* this is the default */
469 } else {
470 errx(EXIT_FAILURE, "invalid aio mode `%s'", optarg);
472 break;
473 #endif
474 case QEMU_NBD_OPT_DISCARD:
475 if (seen_discard) {
476 errx(EXIT_FAILURE, "--discard can only be specified once");
478 seen_discard = true;
479 if (bdrv_parse_discard_flags(optarg, &flags) == -1) {
480 errx(EXIT_FAILURE, "Invalid discard mode `%s'", optarg);
482 break;
483 case 'b':
484 bindto = optarg;
485 break;
486 case 'p':
487 li = strtol(optarg, &end, 0);
488 if (*end) {
489 errx(EXIT_FAILURE, "Invalid port `%s'", optarg);
491 if (li < 1 || li > 65535) {
492 errx(EXIT_FAILURE, "Port out of range `%s'", optarg);
494 port = (uint16_t)li;
495 break;
496 case 'o':
497 dev_offset = strtoll (optarg, &end, 0);
498 if (*end) {
499 errx(EXIT_FAILURE, "Invalid offset `%s'", optarg);
501 if (dev_offset < 0) {
502 errx(EXIT_FAILURE, "Offset must be positive `%s'", optarg);
504 break;
505 case 'l':
506 if (strstart(optarg, SNAPSHOT_OPT_BASE, NULL)) {
507 sn_opts = qemu_opts_parse(&internal_snapshot_opts, optarg, 0);
508 if (!sn_opts) {
509 errx(EXIT_FAILURE, "Failed in parsing snapshot param `%s'",
510 optarg);
512 } else {
513 sn_id_or_name = optarg;
515 /* fall through */
516 case 'r':
517 nbdflags |= NBD_FLAG_READ_ONLY;
518 flags &= ~BDRV_O_RDWR;
519 break;
520 case 'P':
521 partition = strtol(optarg, &end, 0);
522 if (*end)
523 errx(EXIT_FAILURE, "Invalid partition `%s'", optarg);
524 if (partition < 1 || partition > 8)
525 errx(EXIT_FAILURE, "Invalid partition %d", partition);
526 break;
527 case 'k':
528 sockpath = optarg;
529 if (sockpath[0] != '/')
530 errx(EXIT_FAILURE, "socket path must be absolute\n");
531 break;
532 case 'd':
533 disconnect = true;
534 break;
535 case 'c':
536 device = optarg;
537 break;
538 case 'e':
539 shared = strtol(optarg, &end, 0);
540 if (*end) {
541 errx(EXIT_FAILURE, "Invalid shared device number '%s'", optarg);
543 if (shared < 1) {
544 errx(EXIT_FAILURE, "Shared device number must be greater than 0\n");
546 break;
547 case 'f':
548 fmt = optarg;
549 break;
550 case 't':
551 persistent = 1;
552 break;
553 case 'v':
554 verbose = 1;
555 break;
556 case 'V':
557 version(argv[0]);
558 exit(0);
559 break;
560 case 'h':
561 usage(argv[0]);
562 exit(0);
563 break;
564 case '?':
565 errx(EXIT_FAILURE, "Try `%s --help' for more information.",
566 argv[0]);
570 if ((argc - optind) != 1) {
571 errx(EXIT_FAILURE, "Invalid number of argument.\n"
572 "Try `%s --help' for more information.",
573 argv[0]);
576 if (disconnect) {
577 fd = open(argv[optind], O_RDWR);
578 if (fd < 0) {
579 err(EXIT_FAILURE, "Cannot open %s", argv[optind]);
581 nbd_disconnect(fd);
583 close(fd);
585 printf("%s disconnected\n", argv[optind]);
587 return 0;
590 if (device && !verbose) {
591 int stderr_fd[2];
592 pid_t pid;
593 int ret;
595 if (qemu_pipe(stderr_fd) < 0) {
596 err(EXIT_FAILURE, "Error setting up communication pipe");
599 /* Now daemonize, but keep a communication channel open to
600 * print errors and exit with the proper status code.
602 pid = fork();
603 if (pid == 0) {
604 close(stderr_fd[0]);
605 ret = qemu_daemon(1, 0);
607 /* Temporarily redirect stderr to the parent's pipe... */
608 dup2(stderr_fd[1], STDERR_FILENO);
609 if (ret < 0) {
610 err(EXIT_FAILURE, "Failed to daemonize");
613 /* ... close the descriptor we inherited and go on. */
614 close(stderr_fd[1]);
615 } else {
616 bool errors = false;
617 char *buf;
619 /* In the parent. Print error messages from the child until
620 * it closes the pipe.
622 close(stderr_fd[1]);
623 buf = g_malloc(1024);
624 while ((ret = read(stderr_fd[0], buf, 1024)) > 0) {
625 errors = true;
626 ret = qemu_write_full(STDERR_FILENO, buf, ret);
627 if (ret < 0) {
628 exit(EXIT_FAILURE);
631 if (ret < 0) {
632 err(EXIT_FAILURE, "Cannot read from daemon");
635 /* Usually the daemon should not print any message.
636 * Exit with zero status in that case.
638 exit(errors);
642 if (device != NULL && sockpath == NULL) {
643 sockpath = g_malloc(128);
644 snprintf(sockpath, 128, SOCKET_PATH, basename(device));
647 qemu_init_main_loop();
648 bdrv_init();
649 atexit(bdrv_close_all);
651 if (fmt) {
652 drv = bdrv_find_format(fmt);
653 if (!drv) {
654 errx(EXIT_FAILURE, "Unknown file format '%s'", fmt);
656 } else {
657 drv = NULL;
660 bs = bdrv_new("hda");
661 srcpath = argv[optind];
662 ret = bdrv_open(&bs, srcpath, NULL, NULL, flags, drv, &local_err);
663 if (ret < 0) {
664 errno = -ret;
665 err(EXIT_FAILURE, "Failed to bdrv_open '%s': %s", argv[optind],
666 error_get_pretty(local_err));
669 if (sn_opts) {
670 ret = bdrv_snapshot_load_tmp(bs,
671 qemu_opt_get(sn_opts, SNAPSHOT_OPT_ID),
672 qemu_opt_get(sn_opts, SNAPSHOT_OPT_NAME),
673 &local_err);
674 } else if (sn_id_or_name) {
675 ret = bdrv_snapshot_load_tmp_by_id_or_name(bs, sn_id_or_name,
676 &local_err);
678 if (ret < 0) {
679 errno = -ret;
680 err(EXIT_FAILURE,
681 "Failed to load snapshot: %s",
682 error_get_pretty(local_err));
685 fd_size = bdrv_getlength(bs);
687 if (partition != -1) {
688 ret = find_partition(bs, partition, &dev_offset, &fd_size);
689 if (ret < 0) {
690 errno = -ret;
691 err(EXIT_FAILURE, "Could not find partition %d", partition);
695 exp = nbd_export_new(bs, dev_offset, fd_size, nbdflags, nbd_export_closed);
697 if (sockpath) {
698 fd = unix_socket_incoming(sockpath);
699 } else {
700 fd = tcp_socket_incoming(bindto, port);
703 if (fd < 0) {
704 return 1;
707 if (device) {
708 int ret;
710 ret = pthread_create(&client_thread, NULL, nbd_client_thread, device);
711 if (ret != 0) {
712 errx(EXIT_FAILURE, "Failed to create client thread: %s",
713 strerror(ret));
715 } else {
716 /* Shut up GCC warnings. */
717 memset(&client_thread, 0, sizeof(client_thread));
720 qemu_set_fd_handler2(fd, nbd_can_accept, nbd_accept, NULL,
721 (void *)(uintptr_t)fd);
723 /* now when the initialization is (almost) complete, chdir("/")
724 * to free any busy filesystems */
725 if (chdir("/") < 0) {
726 err(EXIT_FAILURE, "Could not chdir to root directory");
729 state = RUNNING;
730 do {
731 main_loop_wait(false);
732 if (state == TERMINATE) {
733 state = TERMINATING;
734 nbd_export_close(exp);
735 nbd_export_put(exp);
736 exp = NULL;
738 } while (state != TERMINATED);
740 bdrv_close(bs);
741 if (sockpath) {
742 unlink(sockpath);
745 if (sn_opts) {
746 qemu_opts_del(sn_opts);
749 if (device) {
750 void *ret;
751 pthread_join(client_thread, &ret);
752 exit(ret != NULL);
753 } else {
754 exit(EXIT_SUCCESS);