mirror of
https://github.com/xemu-project/xemu.git
synced 2024-11-24 03:59:52 +00:00
d470ad42ac
We currently do not guard everywhere against a NULL bs->drv where we should be doing so. Most of the places fixed here just do not care about that case at all. Some care implicitly, e.g. through a prior function call to bdrv_getlength() which would always fail for an ejected BDS. Add an assert there to make it more obvious. Other places seem to care, but do so insufficiently: Freeing clusters in a qcow2 image is an error-free operation, but it may leave the image in an unusable state anyway. Giving qcow2_free_clusters() an error code is not really viable, it is much easier to note that bs->drv may be NULL even after a successful driver call. This concerns bdrv_co_flush(), and the way the check is added to bdrv_co_pdiscard() (in every iteration instead of only once). Finally, some places employ at least an assert(bs->drv); somewhere, that may be reasonable (such as in the reopen code), but in bdrv_has_zero_init(), it is definitely not. Returning 0 there in case of an ejected BDS saves us much headache instead. Reported-by: R. Nageswara Sastry <nasastry@in.ibm.com> Buglink: https://bugs.launchpad.net/qemu/+bug/1728660 Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20171110203111.7666-4-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
366 lines
12 KiB
Bash
Executable File
366 lines
12 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Test case for image corruption (overlapping data structures) in qcow2
|
|
#
|
|
# Copyright (C) 2013 Red Hat, Inc.
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# creator
|
|
owner=mreitz@redhat.com
|
|
|
|
seq="$(basename $0)"
|
|
echo "QA output created by $seq"
|
|
|
|
here="$PWD"
|
|
status=1 # failure is the default!
|
|
|
|
_cleanup()
|
|
{
|
|
_cleanup_test_img
|
|
}
|
|
trap "_cleanup; exit \$status" 0 1 2 3 15
|
|
|
|
# get standard environment, filters and checks
|
|
. ./common.rc
|
|
. ./common.filter
|
|
|
|
# This tests qocw2-specific low-level functionality
|
|
_supported_fmt qcow2
|
|
_supported_proto file
|
|
_supported_os Linux
|
|
|
|
rt_offset=65536 # 0x10000 (XXX: just an assumption)
|
|
rb_offset=131072 # 0x20000 (XXX: just an assumption)
|
|
l1_offset=196608 # 0x30000 (XXX: just an assumption)
|
|
l2_offset=262144 # 0x40000 (XXX: just an assumption)
|
|
l2_offset_after_snapshot=524288 # 0x80000 (XXX: just an assumption)
|
|
|
|
IMGOPTS="compat=1.1"
|
|
|
|
OPEN_RW="open -o overlap-check=all $TEST_IMG"
|
|
# Overlap checks are done before write operations only, therefore opening an
|
|
# image read-only makes the overlap-check option irrelevant
|
|
OPEN_RO="open -r $TEST_IMG"
|
|
|
|
echo
|
|
echo "=== Testing L2 reference into L1 ==="
|
|
echo
|
|
_make_test_img 64M
|
|
# Link first L1 entry (first L2 table) onto itself
|
|
# (Note the MSb in the L1 entry is set, ensuring the refcount is one - else any
|
|
# later write will result in a COW operation, effectively ruining this attempt
|
|
# on image corruption)
|
|
poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x03\x00\x00"
|
|
_check_test_img
|
|
|
|
# The corrupt bit should not be set anyway
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
# Try to write something, thereby forcing the corrupt bit to be set
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
|
|
|
|
# The corrupt bit must now be set
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
# This information should be available through qemu-img info
|
|
_img_info --format-specific
|
|
|
|
# Try to open the image R/W (which should fail)
|
|
$QEMU_IO -c "$OPEN_RW" -c "read 0 512" 2>&1 | _filter_qemu_io \
|
|
| _filter_testdir \
|
|
| _filter_imgfmt
|
|
|
|
# Try to open it RO (which should succeed)
|
|
$QEMU_IO -c "$OPEN_RO" -c "read 0 512" | _filter_qemu_io
|
|
|
|
# We could now try to fix the image, but this would probably fail (how should an
|
|
# L2 table linked onto the L1 table be fixed?)
|
|
|
|
echo
|
|
echo "=== Testing cluster data reference into refcount block ==="
|
|
echo
|
|
_make_test_img 64M
|
|
# Allocate L2 table
|
|
truncate -s "$(($l2_offset+65536))" "$TEST_IMG"
|
|
poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x00\x00"
|
|
# Mark cluster as used
|
|
poke_file "$TEST_IMG" "$(($rb_offset+8))" "\x00\x01"
|
|
# Redirect new data cluster onto refcount block
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x02\x00\x00"
|
|
_check_test_img
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
# Try to fix it
|
|
_check_test_img -r all
|
|
|
|
# The corrupt bit should be cleared
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
# Look if it's really really fixed
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
echo
|
|
echo "=== Testing cluster data reference into inactive L2 table ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 1 0 512" | _filter_qemu_io
|
|
$QEMU_IMG snapshot -c foo "$TEST_IMG"
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 2 0 512" | _filter_qemu_io
|
|
# The inactive L2 table remains at its old offset
|
|
poke_file "$TEST_IMG" "$l2_offset_after_snapshot" \
|
|
"\x80\x00\x00\x00\x00\x04\x00\x00"
|
|
_check_test_img
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 3 0 512" | _filter_qemu_io
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
_check_test_img -r all
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
$QEMU_IO -c "$OPEN_RW" -c "write -P 4 0 512" | _filter_qemu_io
|
|
$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
|
|
|
|
# Check data
|
|
$QEMU_IO -c "$OPEN_RO" -c "read -P 4 0 512" | _filter_qemu_io
|
|
$QEMU_IMG snapshot -a foo "$TEST_IMG"
|
|
_check_test_img
|
|
$QEMU_IO -c "$OPEN_RO" -c "read -P 1 0 512" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing overlap while COW is in flight ==="
|
|
echo
|
|
# compat=0.10 is required in order to make the following discard actually
|
|
# unallocate the sector rather than make it a zero sector - we want COW, after
|
|
# all.
|
|
IMGOPTS='compat=0.10' _make_test_img 1G
|
|
# Write two clusters, the second one enforces creation of an L2 table after
|
|
# the first data cluster.
|
|
$QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io
|
|
# Discard the first cluster. This cluster will soon enough be reallocated and
|
|
# used for COW.
|
|
$QEMU_IO -c 'discard 0k 64k' "$TEST_IMG" | _filter_qemu_io
|
|
# Now, corrupt the image by marking the second L2 table cluster as free.
|
|
poke_file "$TEST_IMG" '131084' "\x00\x00" # 0x2000c
|
|
# Start a write operation requiring COW on the image stopping it right before
|
|
# doing the read; then, trigger the corruption prevention by writing anything to
|
|
# any unallocated cluster, leading to an attempt to overwrite the second L2
|
|
# table. Finally, resume the COW write and see it fail (but not crash).
|
|
echo "open -o file.driver=blkdebug $TEST_IMG
|
|
break cow_read 0
|
|
aio_write 0k 1k
|
|
wait_break 0
|
|
write 64k 64k
|
|
resume 0" | $QEMU_IO | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing unallocated image header ==="
|
|
echo
|
|
_make_test_img 64M
|
|
# Create L1/L2
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$rb_offset" "\x00\x00"
|
|
$QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing unaligned L1 entry ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
# This will be masked with ~(512 - 1) = ~0x1ff, so whether the lower 9 bits are
|
|
# aligned or not does not matter
|
|
poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
|
|
$QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
# Test how well zero cluster expansion can cope with this
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
|
|
$QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
|
|
|
|
echo
|
|
echo "=== Testing unaligned L2 entry ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
|
|
$QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing unaligned pre-allocated zero cluster ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x01"
|
|
# zero cluster expansion
|
|
$QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
|
|
|
|
echo
|
|
echo "=== Testing unaligned reftable entry ==="
|
|
echo
|
|
_make_test_img 64M
|
|
poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x02\x2a\x00"
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing non-fatal corruption on freeing ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
|
|
$QEMU_IO -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing read-only corruption report ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
|
|
# Should only emit a single error message
|
|
$QEMU_IO -c "$OPEN_RO" -c "read 0 64k" -c "read 0 64k" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing non-fatal and then fatal corruption report ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
|
|
poke_file "$TEST_IMG" "$(($l2_offset+8))" "\x80\x00\x00\x00\x00\x06\x2a\x00"
|
|
# Should emit two error messages
|
|
$QEMU_IO -c "discard 0 64k" -c "read 64k 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing empty refcount table ==="
|
|
echo
|
|
_make_test_img 64M
|
|
poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
# Repair the image
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Testing empty refcount table with valid L1 and L2 tables ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
# Since the first data cluster is already allocated this triggers an
|
|
# allocation with an explicit offset (using qcow2_alloc_clusters_at())
|
|
# causing a refcount block to be allocated at offset 0
|
|
$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
|
|
# Repair the image
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Testing empty refcount block ==="
|
|
echo
|
|
_make_test_img 64M
|
|
poke_file "$TEST_IMG" "$rb_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
# Repair the image
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Testing empty refcount block with compressed write ==="
|
|
echo
|
|
_make_test_img 64M
|
|
$QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
|
|
poke_file "$TEST_IMG" "$rb_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
# The previous write already allocated an L2 table, so now this new
|
|
# write will try to allocate a compressed data cluster at offset 0.
|
|
$QEMU_IO -c "write -c 0k 64k" "$TEST_IMG" | _filter_qemu_io
|
|
# Repair the image
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Testing zero refcount table size ==="
|
|
echo
|
|
_make_test_img 64M
|
|
poke_file "$TEST_IMG" "56" "\x00\x00\x00\x00"
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
|
|
# Repair the image
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Testing incorrect refcount table offset ==="
|
|
echo
|
|
_make_test_img 64M
|
|
poke_file "$TEST_IMG" "48" "\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
echo
|
|
echo "=== Testing dirty corrupt image ==="
|
|
echo
|
|
|
|
_make_test_img 64M
|
|
|
|
# Let the refblock appear unaligned
|
|
poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\xff\xff\x2a\x00"
|
|
# Mark the image dirty, thus forcing an automatic check when opening it
|
|
poke_file "$TEST_IMG" 72 "\x00\x00\x00\x00\x00\x00\x00\x01"
|
|
# Open the image (qemu should refuse to do so)
|
|
$QEMU_IO -c close "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
|
|
|
|
echo '--- Repairing ---'
|
|
|
|
# The actual repair should have happened (because of the dirty bit),
|
|
# but some cleanup may have failed (like freeing the old reftable)
|
|
# because the image was already marked corrupt by that point
|
|
_check_test_img -r all
|
|
|
|
echo
|
|
echo "=== Writing to an unaligned preallocated zero cluster ==="
|
|
echo
|
|
|
|
_make_test_img 64M
|
|
|
|
# Allocate the L2 table
|
|
$QEMU_IO -c "write 0 64k" -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
# Pretend there is a preallocated zero cluster somewhere inside the
|
|
# image header
|
|
poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x00\x2a\x01"
|
|
# Let's write to it!
|
|
$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
|
|
|
|
# Can't repair this yet (TODO: We can just deallocate the cluster)
|
|
|
|
echo
|
|
echo '=== Discarding with an unaligned refblock ==='
|
|
echo
|
|
|
|
_make_test_img 64M
|
|
|
|
$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
|
|
# Make our refblock unaligned
|
|
poke_file "$TEST_IMG" "$(($rt_offset))" "\x00\x00\x00\x00\x00\x00\x2a\x00"
|
|
# Now try to discard something that will be submitted as two requests
|
|
# (main part + tail)
|
|
$QEMU_IO -c "discard 0 65537" "$TEST_IMG"
|
|
|
|
echo '--- Repairing ---'
|
|
# Fails the first repair because the corruption prevents the check
|
|
# function from double-checking
|
|
# (Using -q for the first invocation, because otherwise the
|
|
# double-check error message appears above the summary for some
|
|
# reason -- so let's just hide the summary)
|
|
_check_test_img -q -r all
|
|
_check_test_img -r all
|
|
|
|
# success, all done
|
|
echo "*** done"
|
|
rm -f $seq.full
|
|
status=0
|