@samitouri / QOSamiQemu / commits / dc04053687

dirty-bitmap: fix integer overflow in serialization coverage

The chunk size is an int and is shifted left by 3 before the result is widened, so a chunk size of 1 << 28 or above overflows. parallels passes s->cluster_size, which parallels_open() lets reach 2 GiB. With a bitmap needing two L1 entries the bogus limit makes the "bm_size - offset" in parallels_load_bitmap_data() underflow; both wrong values slip past the assertions in serialization_chunk() and the resulting index lands outside the hbitmap, so a 128 KiB image memsets unrelated memory through hbitmap_deserialize_ones(). Widen the shift. qcow2, the only other caller, never exceeds a 2 MiB cluster. Fixes: 35f428ba3971 ("qcow2-bitmap: make bytes_covered_by_bitmap_cluster() public") Cc: Eric Blake <eblake@redhat.com> Cc: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-ID: <20260811173857.396571-4-den@openvz.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>

Denis V. Lunev committed Aug 11, 2026 at 19:38 UTC dc04053687ec7219a78f9b90fe2f71c9336914e1

1 file changed +1 -1

block/dirty-bitmap.c

+1 -1

@@ -612,7 +612,7 @@ uint64_t bdrv_dirty_bitmap_serialization_coverage(int serialized_chunk_size,

612 const BdrvDirtyBitmap *bitmap)

613 {

614 uint64_t granularity = bdrv_dirty_bitmap_granularity(bitmap);

615 - uint64_t limit = granularity * (serialized_chunk_size << 3);

615 + uint64_t limit = granularity * ((uint64_t)serialized_chunk_size << 3);

616

617 assert(QEMU_IS_ALIGNED(limit,

618 bdrv_dirty_bitmap_serialization_align(bitmap)));