[qemu-xen stable-4.13] qcow2-bitmap: Fix uint64_t left-shift overflow

[patchbot@xxxxxxx]

commit 40df4a1bf7520e0713273d6ebd5a3407b4d83267
Author:     Tuguoyi <tu.guoyi@xxxxxxx>
AuthorDate: Fri Nov 1 07:37:35 2019 +0000
Commit:     Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
CommitDate: Tue Nov 12 11:59:58 2019 -0600

    qcow2-bitmap: Fix uint64_t left-shift overflow
    
    There are two issues in In check_constraints_on_bitmap(),
    1) The sanity check on the granularity will cause uint64_t
    integer left-shift overflow when cluster_size is 2M and the
    granularity is BIGGER than 32K.
    2) The way to calculate image size that the maximum bitmap
    supported can map to is a bit incorrect.
    This patch fix it by add a helper function to calculate the
    number of bytes needed by a normal bitmap in image and compare
    it to the maximum bitmap bytes supported by qemu.
    
    Fixes: 5f72826e7fc62167cf3a
    Signed-off-by: Guoyi Tu <tu.guoyi@xxxxxxx>
    Message-id: 4ba40cd1e7ee4a708b40899952e49f22@xxxxxxx
    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@xxxxxxxxxxxxx>
    Cc: qemu-stable@xxxxxxxxxx
    Signed-off-by: Max Reitz <mreitz@xxxxxxxxxx>
    (cherry picked from commit 570542ecb11e04b61ef4b3f4d0965a6915232a88)
    Signed-off-by: Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
---
 block/qcow2-bitmap.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index b2487101ed..65034da1c0 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -142,6 +142,13 @@ static int check_table_entry(uint64_t entry, int 
cluster_size)
     return 0;
 }
 
+static int64_t get_bitmap_bytes_needed(int64_t len, uint32_t granularity)
+{
+    int64_t num_bits = DIV_ROUND_UP(len, granularity);
+
+    return DIV_ROUND_UP(num_bits, 8);
+}
+
 static int check_constraints_on_bitmap(BlockDriverState *bs,
                                        const char *name,
                                        uint32_t granularity,
@@ -150,6 +157,7 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
     BDRVQcow2State *s = bs->opaque;
     int granularity_bits = ctz32(granularity);
     int64_t len = bdrv_getlength(bs);
+    int64_t bitmap_bytes;
 
     assert(granularity > 0);
     assert((granularity & (granularity - 1)) == 0);
@@ -171,9 +179,9 @@ static int check_constraints_on_bitmap(BlockDriverState *bs,
         return -EINVAL;
     }
 
-    if ((len > (uint64_t)BME_MAX_PHYS_SIZE << granularity_bits) ||
-        (len > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size <<
-               granularity_bits))
+    bitmap_bytes = get_bitmap_bytes_needed(len, granularity);
+    if ((bitmap_bytes > (uint64_t)BME_MAX_PHYS_SIZE) ||
+        (bitmap_bytes > (uint64_t)BME_MAX_TABLE_SIZE * s->cluster_size))
     {
         error_setg(errp, "Too much space will be occupied by the bitmap. "
                    "Use larger granularity");
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.13