Am 06.05.2025 um 16:13 hat [email protected] geschrieben:
> From: Denis Rastyogin <[email protected]>
>
> This error was discovered by fuzzing qemu-img.
>
> The current offset calculation leads to an EIO error
> in block/block-backend.c: blk_check_byte_request():
>
> if (offset > len || len - offset < bytes) {
> return -EIO;
> }
>
> This triggers the error message:
> "qemu-img: Failed request: Input/output error".
>
> Example of the issue:
> offset: 260076
> len: 260096
> bytes: 4096
>
> This fix ensures that offset remains within a valid range.
>
> Signed-off-by: Denis Rastyogin <[email protected]>
> ---
> qemu-img.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/qemu-img.c b/qemu-img.c
> index 76ac5d3028..e64acfafb3 100644
> --- a/qemu-img.c
> +++ b/qemu-img.c
> @@ -4488,10 +4488,10 @@ static void bench_cb(void *opaque, int ret)
> */
> b->in_flight++;
> b->offset += b->step;
> - if (b->image_size == 0) {
> + if (b->image_size - b->bufsize <= 0) {
The result of b->image_size - b->bufsize is unsigned, so this doesn't do
what it looks like. I'm replacing it with b->image_size <= b->bufsize.
> b->offset = 0;
> } else {
> - b->offset %= b->image_size;
> + b->offset %= b->image_size - b->bufsize;
> }
> if (b->write) {
> acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b);
Thanks, applied to the block branch.
Kevin
