rpms/kvm/F-8 kvm-60-block-rw-range-check.patch, NONE, 1.1 kvm.spec, 1.29, 1.30

[Daniel P. Berrange (berrange)]

Author: berrange

Update of /cvs/extras/rpms/kvm/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv10012

Modified Files:
	kvm.spec 
Added Files:
	kvm-60-block-rw-range-check.patch 
Log Message:
Fix block device extents check (rhbz #433560)

kvm-60-block-rw-range-check.patch:

--- NEW FILE kvm-60-block-rw-range-check.patch ---
diff -rup kvm-61.orig/qemu/block.c kvm-61.new/qemu/block.c
--- kvm-61.orig/qemu/block.c	2008-02-19 09:58:28.000000000 -0500
+++ kvm-61.new/qemu/block.c	2008-02-23 11:09:21.000000000 -0500
@@ -124,6 +124,24 @@ void path_combine(char *dest, int dest_s
     }
 }
 
+static int bdrv_rw_badreq_sectors(BlockDriverState *bs,
+				int64_t sector_num, int nb_sectors)
+{
+    return
+	nb_sectors < 0 ||
+	nb_sectors > bs->total_sectors ||
+	sector_num > bs->total_sectors - nb_sectors;
+}
+
+static int bdrv_rw_badreq_bytes(BlockDriverState *bs,
+				  int64_t offset, int count)
+{
+    int64_t size = bs->total_sectors << SECTOR_BITS;
+    return
+	count < 0 ||
+	count > size ||
+	offset > size - count;
+}
 
 static void bdrv_register(BlockDriver *bdrv)
 {
@@ -376,6 +394,7 @@ int bdrv_open2(BlockDriverState *bs, con
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
+    bs->total_sectors = 0; /* driver will set if it does not do getlength */
     if (bs->opaque == NULL && drv->instance_size > 0)
         return -1;
     /* Note: for compatibility, we open disk image files as RDWR, and
@@ -441,6 +460,7 @@ void bdrv_close(BlockDriverState *bs)
         bs->drv = NULL;
 
         /* call the change callback */
+	bs->total_sectors = 0;
         bs->media_changed = 1;
         if (bs->change_cb)
             bs->change_cb(bs->change_opaque);
@@ -506,6 +526,8 @@ int bdrv_read(BlockDriverState *bs, int6
     if (!drv)
         return -ENOMEDIUM;
 
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
             memcpy(buf, bs->boot_sector_data, 512);
         sector_num++;
@@ -546,6 +568,8 @@ int bdrv_write(BlockDriverState *bs, int
         return -ENOMEDIUM;
     if (bs->read_only)
         return -EACCES;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);
     }
@@ -671,6 +695,8 @@ int bdrv_pread(BlockDriverState *bs, int
         return -ENOMEDIUM;
     if (!drv->bdrv_pread)
         return bdrv_pread_em(bs, offset, buf1, count1);
+    if (bdrv_rw_badreq_bytes(bs, offset, count1))
+	return -EDOM;
     return drv->bdrv_pread(bs, offset, buf1, count1);
 }
 
@@ -686,6 +712,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
         return -ENOMEDIUM;
     if (!drv->bdrv_pwrite)
         return bdrv_pwrite_em(bs, offset, buf1, count1);
+    if (bdrv_rw_badreq_bytes(bs, offset, count1))
+	return -EDOM;
     return drv->bdrv_pwrite(bs, offset, buf1, count1);
 }
 
@@ -1091,6 +1119,8 @@ int bdrv_write_compressed(BlockDriverSta
         return -ENOMEDIUM;
     if (!drv->bdrv_write_compressed)
         return -ENOTSUP;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return -EDOM;
     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
 }
 
@@ -1237,6 +1267,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
 
     if (!drv)
         return NULL;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return NULL;
 
     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
@@ -1268,6 +1300,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
         return NULL;
     if (bs->read_only)
         return NULL;
+    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+	return NULL;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);
     }


Index: kvm.spec
===================================================================
RCS file: /cvs/extras/rpms/kvm/F-8/kvm.spec,v
retrieving revision 1.29
retrieving revision 1.30
diff -u -r1.29 -r1.30
--- kvm.spec	18 Feb 2008 18:40:35 -0000	1.29
+++ kvm.spec	23 Feb 2008 16:25:59 -0000	1.30
@@ -1,13 +1,14 @@
 Summary: Kernel-based Virtual Machine
 Name: kvm
 Version: 60
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+ and LGPLv2+
 Group: Development/Tools
 URL: http://%{name}.sf.net
 Source0: http://download.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.gz
 Source1: %{name}.modules
 Patch1: %{name}-bootmenu.patch
+Patch2: %{name}-%{version}-block-rw-range-check.patch
 # patches from upstream qemu
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel
@@ -37,6 +38,7 @@
 %prep
 %setup -q
 %patch1 -p1
+%patch2 -p1
 
 %build
 # we need to install the data bits in a different path
@@ -91,6 +93,9 @@
 %{_sysconfdir}/sysconfig/modules/%{name}.modules
 
 %changelog
+* Sat Feb 23 2008 Daniel P. Berrange <berrange at redhat.com> - 60-2.fc8
+- Fix block device extents check (rhbz #433560)
+
 * Thu Jan 31 2008 Jeremy Katz <katzj at redhat.com> 
 - We don't need e2fsprogs-devel to build anymore (#331871)