Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2017-11-14' into staging

Block patches for 2.11.0-rc1

# gpg: Signature made Tue 14 Nov 2017 17:22:17 GMT
# gpg:                using RSA key 0xF407DB0061D5CF40
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2017-11-14:
  qemu-iotests: update unsupported image formats in 194
  block/parallels: add migration blocker
  block/parallels: Do not update header or truncate image when INMIGRATE
  block/vhdx.c: Don't blindly update the header
  iotests: 077: Filter out 'resume' lines
  block/snapshot: dirty all dirty bitmaps on snapshot-switch
  qcow2: Check that corrupted images can be repaired in iotest 060
  iotests: Use new-style NBD connections
  iotests: Make 136 less flaky
  iotests: Make 083 less flaky
  iotests: Make 055 less flaky
  iotests: Add missing 'blkdebug::' in 040
  iotests: Make 030 less flaky
  qcow2: Assert that the crypto header does not overlap other metadata
  qcow2: Add iotest for an empty refcount table
  qcow2: Add iotest for an image with header.refcount_table_offset == 0
  qcow2: Don't open images with header.refcount_table_clusters == 0
  qcow2: Prevent allocating compressed clusters at offset 0
  qcow2: Prevent allocating L2 tables at offset 0
  qcow2: Prevent allocating refcount blocks at offset 0

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

1 files changed, 14 insertions, 0 deletions

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index aa3fd6cf17..60b8eef3e8 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -367,6 +367,13 @@ static int alloc_refcount_block(BlockDriverState *bs,
         return new_block;
     }
 
+    /* If we're allocating the block at offset 0 then something is wrong */
+    if (new_block == 0) {
+        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
+                                "allocation of refcount block at offset 0");
+        return -EIO;
+    }
+
 #ifdef DEBUG_ALLOC2
     fprintf(stderr, "qcow2: Allocate refcount block %d for %" PRIx64
         " at %" PRIx64 "\n",
@@ -1075,6 +1082,13 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
                 return new_cluster;
             }
 
+            if (new_cluster == 0) {
+                qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
+                                        "allocation of compressed cluster "
+                                        "at offset 0");
+                return -EIO;
+            }
+
             if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) {
                 offset = new_cluster;
                 free_in_cluster = s->cluster_size;