qemu/qemu.git/block/parallels.c, branch master

parallels: validate BAT capacity against advertised disk size

2026-07-28T14:55:00+00:00

parallels_open() copied nb_sectors, tracks, and bat_entries from the image header without checking that the BAT actually covers the advertised virtual disk size. An image whose header claims more sectors than its BAT covers passes the generic block-layer bounds check on open. A write into the gap between BAT coverage and the advertised size then reaches allocate_clusters(), whose internal assert(idx < s->bat_size && idx + to_allocate <= s->bat_size) aborts the process instead of returning a normal I/O error. Reject such images at open time by requiring bat_size * tracks >= total_sectors, matching the invariant that allocate_clusters() already assumes. Reported-by: Feifan Qian Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3804 Signed-off-by: Denis V. Lunev CC: Thomas Huth CC: Stefan Hajnoczi

parallels: reject BAT entries pointing outside backed storage

2026-07-28T14:42:45+00:00

parallels_open()'s BAT scan and parallels_check_outside_image() only checked entries against the file's upper end, matching just half of what docs/interop/parallels.rst requires: an entry's offset must be both >= data_start and < the file size. An entry below data_start resolves into the header/BAT region itself, corrupting metadata on write or losing the write silently on a partial overlap, and neither qemu-img check nor the open-time scan ever caught it. Check both bounds everywhere a BAT entry is resolved to a host offset: seek_to_sector(), the open-time scan (without letting a bad entry inflate data_end), and parallels_check_outside_image(). Signed-off-by: Denis V. Lunev CC: Thomas Huth CC: Stefan Hajnoczi

parallels: fix bat_entries overflow in image creation

2026-07-28T14:42:45+00:00

parallels_co_create() computed the BAT entry count directly into a uint32_t, wrapping silently to zero at exactly 2^32 entries and writing out a header whose BAT no longer matches its advertised size. Compute it in an int64_t first and reject it once it no longer fits, matching the cap parallels_open() already enforces. Also reject cluster-size 0, and clamp header.cylinders instead of letting it truncate the same way. Signed-off-by: Denis V. Lunev CC: Thomas Huth CC: Stefan Hajnoczi

parallels: read header/BAT table in bounded chunks

2026-07-28T14:42:45+00:00

parallels_open() read the whole header+BAT table with a single bdrv_pread() call sized s->header_size. For an image whose catalog approaches the "Catalog too large" bound (INT_MAX / sizeof(uint32_t) entries), that size approaches BDRV_REQUEST_MAX_BYTES, and the block layer legitimately refuses a single request that large, so the image failed to open with a generic I/O error even though the catalog size itself is within the format's documented limit. Read the header and BAT table in fixed-size chunks instead, so the maximum catalog size parallels_open() can actually address matches the bound it already enforces, independent of the file's block-layer alignment requirements. Signed-off-by: Denis V. Lunev CC: Thomas Huth CC: Stefan Hajnoczi

parallels: fix integer overflow in header size calculation

2026-07-27T12:42:24+00:00

parallels_open() caches bat_entry_off(s->bat_size) - a uint32_t - in a plain int before it feeds into s->header_size. Near the "Catalog too large" bound the value exceeds INT_MAX and overflows on assignment. Match the cached value's type to bat_entry_off()'s return type. Signed-off-by: Denis V. Lunev CC: Thomas Huth CC: Stefan Hajnoczi

block: Allow drivers to control protocol prefix at creation

2025-11-11T21:06:09+00:00

This patch is pure refactoring: instead of hard-coding permission to use a protocol prefix when creating an image, the drivers can now pass in a parameter, comparable to what they could already do for opening a pre-existing image. This patch is purely mechanical (all drivers pass in true for now), but it will enable the next patch to cater to drivers that want to differ in behavior for the primary image vs. any secondary images that are opened at the same time as creating the primary image. Signed-off-by: Eric Blake Message-ID: <20250915213919.3121401-5-eblake@redhat.com> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf

block: Expand block status mode from bool to flags

2025-05-14T20:33:34+00:00

This patch is purely mechanical, changing bool want_zero into an unsigned int for bitwise-or of flags. As of this patch, all implementations are unchanged (the old want_zero==true is now mode==BDRV_WANT_PRECISE which is a superset of BDRV_WANT_ZERO); but the callers in io.c that used to pass want_zero==false are now prepared for future driver changes that can now distinguish bewteen BDRV_WANT_ZERO vs. BDRV_WANT_ALLOCATED. The next patch will actually change the file-posix driver along those lines, now that we have more-specific hints. As for the background why this patch is useful: right now, the file-posix driver recognizes that if allocation is being queried, the entire image can be reported as allocated (there is no backing file to refer to) - but this throws away information on whether the entire image reads as zero (trivially true if lseek(SEEK_HOLE) at offset 0 returns -ENXIO, a bit more complicated to prove if the raw file was created with 'qemu-img create' since we intentionally allocate a small chunk of all-zero data to help with alignment probing). Later patches will add a generic algorithm for seeing if an entire file reads as zeroes. Signed-off-by: Eric Blake Reviewed-by: Stefan Hajnoczi Message-ID: <20250509204341.3553601-16-eblake@redhat.com>

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10T14:33:16+00:00

The general expectation is that header files should follow the same file/path naming scheme as the corresponding source file. There are various historical exceptions to this practice in QEMU, with one of the most notable being the include/qapi/qmp/ directory. Most of the headers there correspond to source files in qobject/. This patch corrects most of that inconsistency by creating include/qobject/ and moving the headers for qobject/ there. This also fixes MAINTAINERS for include/qapi/qmp/dispatch.h: scripts/get_maintainer.pl now reports "QAPI" instead of "No maintainers found". Signed-off-by: Daniel P. Berrangé Reviewed-by: Zhao Liu Acked-by: Halil Pasic #s390x Signed-off-by: Markus Armbruster Message-ID: <20241118151235.2665921-2-armbru@redhat.com> [Rebased]

parallels: fix ext_off assertion failure due to overflow

2025-01-30T20:22:28+00:00

This error was discovered by fuzzing qemu-img. When ph.ext_off has a sufficiently large value, the operation le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS in parallels_read_format_extension() can cause an overflow in int64_t. This overflow triggers the assert(ext_off > 0) check in block/parallels-ext.c: parallels_read_format_extension(), leading to a crash. This commit adds a check to prevent overflow when shifting ph.ext_off by BDRV_SECTOR_BITS, ensuring that the value remains within a valid range. Reported-by: Leonid Reviakin Signed-off-by: Denis Rastyogin Reviewed-by: Denis V. Lunev Message-ID: <20241212104212.513947-2-gerben@altlinux.org> Signed-off-by: Stefan Hajnoczi

include: Rename sysemu/ -> system/

2024-12-20T16:44:56+00:00

Headers in include/sysemu/ are not only related to system *emulation*, they are also used by virtualization. Rename as system/ which is clearer. Files renamed manually then mechanical change using sed tool. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Tested-by: Lei Yang Message-Id: <20241203172445.28576-1-philmd@linaro.org>