qcow2: Prevent allocating refcount blocks at offset 0
commit6bf45d59f98c898b7d7997a333765c8ee41236ea
authorAlberto Garcia <berto@igalia.com>
Fri, 3 Nov 2017 14:18:50 +0000 (3 16:18 +0200)
committerMax Reitz <mreitz@redhat.com>
Tue, 14 Nov 2017 17:06:25 +0000 (14 18:06 +0100)
tree16ac6eaddeef14fc04cbe924d39119ba797bd69e
parent191b5fbfa66e5b23e2150f3c6981d30eb84418a9
qcow2: Prevent allocating refcount blocks at offset 0

Each entry in the qcow2 cache contains an offset field indicating the
location of the data in the qcow2 image. If the offset is 0 then it
means that the entry contains no data and is available to be used when
needed.

Because of that it is not possible to store in the cache the first
cluster of the qcow2 image (offset = 0). This is not a problem because
that cluster always contains the qcow2 header and we're not using this
cache for that.

However, if the qcow2 image is corrupted it can happen that we try to
allocate a new refcount block at offset 0, triggering this assertion
and crashing QEMU:

  qcow2_cache_entry_mark_dirty: Assertion `c->entries[i].offset != 0' failed

This patch adds an explicit check for this scenario and a new test
case.

This problem was originally reported here:

   https://bugs.launchpad.net/qemu/+bug/1728615

Reported-by: R.Nageswara Sastry <nasastry@in.ibm.com>
Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 92a2fadd10d58b423f269c1d1a309af161cdc73f.1509718618.git.berto@igalia.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
block/qcow2-refcount.c
tests/qemu-iotests/060
tests/qemu-iotests/060.out