bochs: Check extent_size header field (CVE-2014-0142)
[qemu.git] / block / bochs.c
1 /*
2 * Block driver for the various disk image formats used by Bochs
3 * Currently only for "growing" type in read-only mode
4 *
5 * Copyright (c) 2005 Alex Beregszaszi
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25 #include "qemu-common.h"
26 #include "block/block_int.h"
27 #include "qemu/module.h"
28
29 /**************************************************************/
30
31 #define HEADER_MAGIC "Bochs Virtual HD Image"
32 #define HEADER_VERSION 0x00020000
33 #define HEADER_V1 0x00010000
34 #define HEADER_SIZE 512
35
36 #define REDOLOG_TYPE "Redolog"
37 #define GROWING_TYPE "Growing"
38
39 // not allocated: 0xffffffff
40
41 // always little-endian
42 struct bochs_header {
43 char magic[32]; /* "Bochs Virtual HD Image" */
44 char type[16]; /* "Redolog" */
45 char subtype[16]; /* "Undoable" / "Volatile" / "Growing" */
46 uint32_t version;
47 uint32_t header; /* size of header */
48
49 uint32_t catalog; /* num of entries */
50 uint32_t bitmap; /* bitmap size */
51 uint32_t extent; /* extent size */
52
53 union {
54 struct {
55 uint32_t reserved; /* for ??? */
56 uint64_t disk; /* disk size */
57 char padding[HEADER_SIZE - 64 - 20 - 12];
58 } QEMU_PACKED redolog;
59 struct {
60 uint64_t disk; /* disk size */
61 char padding[HEADER_SIZE - 64 - 20 - 8];
62 } QEMU_PACKED redolog_v1;
63 char padding[HEADER_SIZE - 64 - 20];
64 } extra;
65 } QEMU_PACKED;
66
67 typedef struct BDRVBochsState {
68 CoMutex lock;
69 uint32_t *catalog_bitmap;
70 uint32_t catalog_size;
71
72 uint32_t data_offset;
73
74 uint32_t bitmap_blocks;
75 uint32_t extent_blocks;
76 uint32_t extent_size;
77 } BDRVBochsState;
78
79 static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
80 {
81 const struct bochs_header *bochs = (const void *)buf;
82
83 if (buf_size < HEADER_SIZE)
84 return 0;
85
86 if (!strcmp(bochs->magic, HEADER_MAGIC) &&
87 !strcmp(bochs->type, REDOLOG_TYPE) &&
88 !strcmp(bochs->subtype, GROWING_TYPE) &&
89 ((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
90 (le32_to_cpu(bochs->version) == HEADER_V1)))
91 return 100;
92
93 return 0;
94 }
95
96 static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
97 Error **errp)
98 {
99 BDRVBochsState *s = bs->opaque;
100 uint32_t i;
101 struct bochs_header bochs;
102 int ret;
103
104 bs->read_only = 1; // no write support yet
105
106 ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
107 if (ret < 0) {
108 return ret;
109 }
110
111 if (strcmp(bochs.magic, HEADER_MAGIC) ||
112 strcmp(bochs.type, REDOLOG_TYPE) ||
113 strcmp(bochs.subtype, GROWING_TYPE) ||
114 ((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
115 (le32_to_cpu(bochs.version) != HEADER_V1))) {
116 error_setg(errp, "Image not in Bochs format");
117 return -EINVAL;
118 }
119
120 if (le32_to_cpu(bochs.version) == HEADER_V1) {
121 bs->total_sectors = le64_to_cpu(bochs.extra.redolog_v1.disk) / 512;
122 } else {
123 bs->total_sectors = le64_to_cpu(bochs.extra.redolog.disk) / 512;
124 }
125
126 /* Limit to 1M entries to avoid unbounded allocation. This is what is
127 * needed for the largest image that bximage can create (~8 TB). */
128 s->catalog_size = le32_to_cpu(bochs.catalog);
129 if (s->catalog_size > 0x100000) {
130 error_setg(errp, "Catalog size is too large");
131 return -EFBIG;
132 }
133
134 s->catalog_bitmap = g_malloc(s->catalog_size * 4);
135
136 ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
137 s->catalog_size * 4);
138 if (ret < 0) {
139 goto fail;
140 }
141
142 for (i = 0; i < s->catalog_size; i++)
143 le32_to_cpus(&s->catalog_bitmap[i]);
144
145 s->data_offset = le32_to_cpu(bochs.header) + (s->catalog_size * 4);
146
147 s->bitmap_blocks = 1 + (le32_to_cpu(bochs.bitmap) - 1) / 512;
148 s->extent_blocks = 1 + (le32_to_cpu(bochs.extent) - 1) / 512;
149
150 s->extent_size = le32_to_cpu(bochs.extent);
151 if (s->extent_size == 0) {
152 error_setg(errp, "Extent size may not be zero");
153 return -EINVAL;
154 } else if (s->extent_size > 0x800000) {
155 error_setg(errp, "Extent size %" PRIu32 " is too large",
156 s->extent_size);
157 return -EINVAL;
158 }
159
160 if (s->catalog_size < bs->total_sectors / s->extent_size) {
161 error_setg(errp, "Catalog size is too small for this disk size");
162 ret = -EINVAL;
163 goto fail;
164 }
165
166 qemu_co_mutex_init(&s->lock);
167 return 0;
168
169 fail:
170 g_free(s->catalog_bitmap);
171 return ret;
172 }
173
174 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
175 {
176 BDRVBochsState *s = bs->opaque;
177 uint64_t offset = sector_num * 512;
178 uint64_t extent_index, extent_offset, bitmap_offset;
179 char bitmap_entry;
180
181 // seek to sector
182 extent_index = offset / s->extent_size;
183 extent_offset = (offset % s->extent_size) / 512;
184
185 if (s->catalog_bitmap[extent_index] == 0xffffffff) {
186 return -1; /* not allocated */
187 }
188
189 bitmap_offset = s->data_offset + (512 * s->catalog_bitmap[extent_index] *
190 (s->extent_blocks + s->bitmap_blocks));
191
192 /* read in bitmap for current extent */
193 if (bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
194 &bitmap_entry, 1) != 1) {
195 return -1;
196 }
197
198 if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
199 return -1; /* not allocated */
200 }
201
202 return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
203 }
204
205 static int bochs_read(BlockDriverState *bs, int64_t sector_num,
206 uint8_t *buf, int nb_sectors)
207 {
208 int ret;
209
210 while (nb_sectors > 0) {
211 int64_t block_offset = seek_to_sector(bs, sector_num);
212 if (block_offset >= 0) {
213 ret = bdrv_pread(bs->file, block_offset, buf, 512);
214 if (ret != 512) {
215 return -1;
216 }
217 } else
218 memset(buf, 0, 512);
219 nb_sectors--;
220 sector_num++;
221 buf += 512;
222 }
223 return 0;
224 }
225
226 static coroutine_fn int bochs_co_read(BlockDriverState *bs, int64_t sector_num,
227 uint8_t *buf, int nb_sectors)
228 {
229 int ret;
230 BDRVBochsState *s = bs->opaque;
231 qemu_co_mutex_lock(&s->lock);
232 ret = bochs_read(bs, sector_num, buf, nb_sectors);
233 qemu_co_mutex_unlock(&s->lock);
234 return ret;
235 }
236
237 static void bochs_close(BlockDriverState *bs)
238 {
239 BDRVBochsState *s = bs->opaque;
240 g_free(s->catalog_bitmap);
241 }
242
243 static BlockDriver bdrv_bochs = {
244 .format_name = "bochs",
245 .instance_size = sizeof(BDRVBochsState),
246 .bdrv_probe = bochs_probe,
247 .bdrv_open = bochs_open,
248 .bdrv_read = bochs_co_read,
249 .bdrv_close = bochs_close,
250 };
251
252 static void bdrv_bochs_init(void)
253 {
254 bdrv_register(&bdrv_bochs);
255 }
256
257 block_init(bdrv_bochs_init);