macio: Fix timer endianness

[qemu.git] / block / qcow2-snapshot.c

diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 7d144205c3fdd65bae8a728e2f9d7ad54bb6bdc7..0aa9defbe29ac298e82c88fbebcbe2a3aaea4261 100644 (file)
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -26,31 +26,6 @@
 #include "block/block_int.h"
 #include "block/qcow2.h"
 
 #include "block/block_int.h"
 #include "block/qcow2.h"
 

-typedef struct QEMU_PACKED QCowSnapshotHeader {
-    /* header is 8 byte aligned */
-    uint64_t l1_table_offset;
-
-    uint32_t l1_size;
-    uint16_t id_str_size;
-    uint16_t name_size;
-
-    uint32_t date_sec;
-    uint32_t date_nsec;
-
-    uint64_t vm_clock_nsec;
-
-    uint32_t vm_state_size;
-    uint32_t extra_data_size; /* for extension */
-    /* extra data follows */
-    /* id_str follows */
-    /* name follows  */
-} QCowSnapshotHeader;
-
-typedef struct QEMU_PACKED QCowSnapshotExtraData {
-    uint64_t vm_state_size_large;
-    uint64_t disk_size;
-} QCowSnapshotExtraData;
-

 void qcow2_free_snapshots(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
 void qcow2_free_snapshots(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;


@@ -141,8 +116,14 @@ int qcow2_read_snapshots(BlockDriverState *bs)
         }
         offset += name_size;
         sn->name[name_size] = '\0';
         }
         offset += name_size;
         sn->name[name_size] = '\0';

+
+        if (offset - s->snapshots_offset > QCOW_MAX_SNAPSHOTS_SIZE) {
+            ret = -EFBIG;
+            goto fail;
+        }

     }
 
     }
 

+    assert(offset - s->snapshots_offset <= INT_MAX);

     s->snapshots_size = offset - s->snapshots_offset;
     return 0;
 
     s->snapshots_size = offset - s->snapshots_offset;
     return 0;
 


@@ -163,7 +144,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
         uint32_t nb_snapshots;
         uint64_t snapshots_offset;
     } QEMU_PACKED header_data;
         uint32_t nb_snapshots;
         uint64_t snapshots_offset;
     } QEMU_PACKED header_data;

-    int64_t offset, snapshots_offset;
+    int64_t offset, snapshots_offset = 0;

     int ret;
 
     /* compute the size of the snapshots */
     int ret;
 
     /* compute the size of the snapshots */


@@ -175,26 +156,33 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
         offset += sizeof(extra);
         offset += strlen(sn->id_str);
         offset += strlen(sn->name);
         offset += sizeof(extra);
         offset += strlen(sn->id_str);
         offset += strlen(sn->name);

+
+        if (offset > QCOW_MAX_SNAPSHOTS_SIZE) {
+            ret = -EFBIG;
+            goto fail;
+        }

     }
     }

+
+    assert(offset <= INT_MAX);

     snapshots_size = offset;
 
     /* Allocate space for the new snapshot list */
     snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
     offset = snapshots_offset;
     if (offset < 0) {
     snapshots_size = offset;
 
     /* Allocate space for the new snapshot list */
     snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
     offset = snapshots_offset;
     if (offset < 0) {

-        return offset;
+        ret = offset;
+        goto fail;

     }
     ret = bdrv_flush(bs);
     if (ret < 0) {
     }
     ret = bdrv_flush(bs);
     if (ret < 0) {

-        return ret;
+        goto fail;

     }
 
     /* The snapshot list position has not yet been updated, so these clusters
      * must indeed be completely free */
     }
 
     /* The snapshot list position has not yet been updated, so these clusters
      * must indeed be completely free */

-    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_DEFAULT, offset,
-                                        s->snapshots_size);
+    ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size);

     if (ret < 0) {
     if (ret < 0) {

-        return ret;
+        goto fail;

     }
 
 
     }
 
 


@@ -220,6 +208,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
 
         id_str_size = strlen(sn->id_str);
         name_size = strlen(sn->name);
 
         id_str_size = strlen(sn->id_str);
         name_size = strlen(sn->name);

+        assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX);

         h.id_str_size = cpu_to_be16(id_str_size);
         h.name_size = cpu_to_be16(name_size);
         offset = align_offset(offset, 8);
         h.id_str_size = cpu_to_be16(id_str_size);
         h.name_size = cpu_to_be16(name_size);
         offset = align_offset(offset, 8);


@@ -278,6 +267,10 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
     return 0;
 
 fail:
     return 0;
 
 fail:

+    if (snapshots_offset > 0) {
+        qcow2_free_clusters(bs, snapshots_offset, snapshots_size,
+                            QCOW2_DISCARD_ALWAYS);
+    }

     return ret;
 }
 
     return ret;
 }
 


@@ -286,7 +279,8 @@ static void find_new_snapshot_id(BlockDriverState *bs,
 {
     BDRVQcowState *s = bs->opaque;
     QCowSnapshot *sn;
 {
     BDRVQcowState *s = bs->opaque;
     QCowSnapshot *sn;

-    int i, id, id_max = 0;
+    int i;
+    unsigned long id, id_max = 0;

 
     for(i = 0; i < s->nb_snapshots; i++) {
         sn = s->snapshots + i;
 
     for(i = 0; i < s->nb_snapshots; i++) {
         sn = s->snapshots + i;


@@ -294,7 +288,7 @@ static void find_new_snapshot_id(BlockDriverState *bs,
         if (id > id_max)
             id_max = id;
     }
         if (id > id_max)
             id_max = id;
     }

-    snprintf(id_str, id_str_size, "%d", id_max + 1);
+    snprintf(id_str, id_str_size, "%lu", id_max + 1);

 }
 
 static int find_snapshot_by_id_and_name(BlockDriverState *bs,
 }
 
 static int find_snapshot_by_id_and_name(BlockDriverState *bs,


@@ -351,6 +345,10 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     uint64_t *l1_table = NULL;
     int64_t l1_table_offset;
 
     uint64_t *l1_table = NULL;
     int64_t l1_table_offset;
 

+    if (s->nb_snapshots >= QCOW_MAX_SNAPSHOTS) {
+        return -EFBIG;
+    }
+

     memset(sn, 0, sizeof(*sn));
 
     /* Generate an ID if it wasn't passed */
     memset(sn, 0, sizeof(*sn));
 
     /* Generate an ID if it wasn't passed */


@@ -388,8 +386,8 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
         l1_table[i] = cpu_to_be64(s->l1_table[i]);
     }
 
         l1_table[i] = cpu_to_be64(s->l1_table[i]);
     }
 

-    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_DEFAULT,
-            sn->l1_table_offset, s->l1_size * sizeof(uint64_t));
+    ret = qcow2_pre_write_overlap_check(bs, 0, sn->l1_table_offset,
+                                        s->l1_size * sizeof(uint64_t));

     if (ret < 0) {
         goto fail;
     }
     if (ret < 0) {
         goto fail;
     }


@@ -427,6 +425,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
     if (ret < 0) {
         g_free(s->snapshots);
         s->snapshots = old_snapshot_list;
     if (ret < 0) {
         g_free(s->snapshots);
         s->snapshots = old_snapshot_list;

+        s->nb_snapshots--;

         goto fail;
     }
 
         goto fail;
     }
 


@@ -513,9 +512,8 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
         goto fail;
     }
 
         goto fail;
     }
 

-    ret = qcow2_pre_write_overlap_check(bs,
-            QCOW2_OL_DEFAULT & ~QCOW2_OL_ACTIVE_L1,
-            s->l1_table_offset, cur_l1_bytes);
+    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
+                                        s->l1_table_offset, cur_l1_bytes);

     if (ret < 0) {
         goto fail;
     }
     if (ret < 0) {
         goto fail;
     }


@@ -600,7 +598,8 @@ int qcow2_snapshot_delete(BlockDriverState *bs,
     s->nb_snapshots--;
     ret = qcow2_write_snapshots(bs);
     if (ret < 0) {
     s->nb_snapshots--;
     ret = qcow2_write_snapshots(bs);
     if (ret < 0) {

-        error_setg(errp, "Failed to remove snapshot from snapshot list");
+        error_setg_errno(errp, -ret,
+                         "Failed to remove snapshot from snapshot list");

         return ret;
     }
 
         return ret;
     }
 


@@ -618,7 +617,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs,
     ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
                                          sn.l1_size, -1);
     if (ret < 0) {
     ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
                                          sn.l1_size, -1);
     if (ret < 0) {

-        error_setg(errp, "Failed to free the cluster and L1 table");
+        error_setg_errno(errp, -ret, "Failed to free the cluster and L1 table");

         return ret;
     }
     qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),
         return ret;
     }
     qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),


@@ -627,7 +626,8 @@ int qcow2_snapshot_delete(BlockDriverState *bs,
     /* must update the copied flag on the current cluster offsets */
     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
     if (ret < 0) {
     /* must update the copied flag on the current cluster offsets */
     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
     if (ret < 0) {

-        error_setg(errp, "Failed to update snapshot status in disk");
+        error_setg_errno(errp, -ret,
+                         "Failed to update snapshot status in disk");

         return ret;
     }
 
         return ret;
     }
 


@@ -669,7 +669,10 @@ int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
     return s->nb_snapshots;
 }
 
     return s->nb_snapshots;
 }
 

-int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name)
+int qcow2_snapshot_load_tmp(BlockDriverState *bs,
+                            const char *snapshot_id,
+                            const char *name,
+                            Error **errp)

 {
     int i, snapshot_index;
     BDRVQcowState *s = bs->opaque;
 {
     int i, snapshot_index;
     BDRVQcowState *s = bs->opaque;


@@ -681,18 +684,25 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name)
     assert(bs->read_only);
 
     /* Search the snapshot */
     assert(bs->read_only);
 
     /* Search the snapshot */

-    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_name);
+    snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);

     if (snapshot_index < 0) {
     if (snapshot_index < 0) {

+        error_setg(errp,
+                   "Can't find snapshot");

         return -ENOENT;
     }
     sn = &s->snapshots[snapshot_index];
 
     /* Allocate and read in the snapshot's L1 table */
         return -ENOENT;
     }
     sn = &s->snapshots[snapshot_index];
 
     /* Allocate and read in the snapshot's L1 table */

-    new_l1_bytes = s->l1_size * sizeof(uint64_t);
+    if (sn->l1_size > QCOW_MAX_L1_SIZE) {
+        error_setg(errp, "Snapshot L1 table too large");
+        return -EFBIG;
+    }
+    new_l1_bytes = sn->l1_size * sizeof(uint64_t);

     new_l1_table = g_malloc0(align_offset(new_l1_bytes, 512));
 
     ret = bdrv_pread(bs->file, sn->l1_table_offset, new_l1_table, new_l1_bytes);
     if (ret < 0) {
     new_l1_table = g_malloc0(align_offset(new_l1_bytes, 512));
 
     ret = bdrv_pread(bs->file, sn->l1_table_offset, new_l1_table, new_l1_bytes);
     if (ret < 0) {

+        error_setg(errp, "Failed to read l1 table for snapshot");

         g_free(new_l1_table);
         return ret;
     }
         g_free(new_l1_table);
         return ret;
     }