From e6fee59a785b0f29794ef1fb508be972c38bc1ad Mon Sep 17 00:00:00 2001
From: Eduardo Habkost <ehabkost@redhat.com>
Date: Tue, 28 Apr 2009 11:06:37 -0300
Subject: [PATCH 06/16] Revert "Fix CVE-2008-0928 - insufficient block device address range checking"

This reverts commit d2f9839082c47048fb1153dcad1eab6c21884f2a.

It will be replaced by a newer fix from upstream, submitted by Kevin Wolf.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-ID: <20090428141452.GF29825@blackpad>
Bugzilla: 501729
RH-Upstream-status: not-applicable
Acked-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Zachary Amsden <zamsden@redhat.com>
Acked-by: Gleb Natapov <gleb@redhat.com>
---
 qemu/block-qcow.c  |    2 +-
 qemu/block-qcow2.c |    2 +-
 qemu/block-vmdk.c  |    2 +-
 qemu/block.c       |   74 ----------------------------------------------------
 qemu/block.h       |    1 -
 qemu/block_int.h   |    1 -
 6 files changed, 3 insertions(+), 79 deletions(-)

diff --git a/qemu/block-qcow.c b/qemu/block-qcow.c
index 62f883c..ab10e91 100644
--- a/qemu/block-qcow.c
+++ b/qemu/block-qcow.c
@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
     int len, i, shift, ret;
     QCowHeader header;
 
-    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+    ret = bdrv_file_open(&s->hd, filename, flags);
     if (ret < 0)
         return ret;
     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
diff --git a/qemu/block-qcow2.c b/qemu/block-qcow2.c
index a8e9e8e..e4a444a 100644
--- a/qemu/block-qcow2.c
+++ b/qemu/block-qcow2.c
@@ -284,7 +284,7 @@ static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
         flags |= BDRV_O_CACHE_WB;
         flags &= ~BDRV_O_CACHE_DEF;
     }
-    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+    ret = bdrv_file_open(&s->hd, filename, flags);
     if (ret < 0)
         return ret;
     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
diff --git a/qemu/block-vmdk.c b/qemu/block-vmdk.c
index c64bd59..cab2078 100644
--- a/qemu/block-vmdk.c
+++ b/qemu/block-vmdk.c
@@ -377,7 +377,7 @@ static int vmdk_open(BlockDriverState *bs, const char *filename, int flags)
         // Parent must be opened as RO.
         flags = BDRV_O_RDONLY;
 
-    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+    ret = bdrv_file_open(&s->hd, filename, flags);
     if (ret < 0)
         return ret;
     if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
diff --git a/qemu/block.c b/qemu/block.c
index c50b636..74a8d99 100644
--- a/qemu/block.c
+++ b/qemu/block.c
@@ -128,60 +128,6 @@ void path_combine(char *dest, int dest_size,
     }
 }
 
-static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
-                                  int64_t sector_num, int nb_sectors)
-{
-    return
-        nb_sectors < 0 ||
-        sector_num < 0 ||
-        nb_sectors > bs->total_sectors ||
-        sector_num > bs->total_sectors - nb_sectors;
-}
-
-static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
-                                int64_t offset, int count)
-{
-    int64_t size = bs->total_sectors << SECTOR_BITS;
-    return
-        count < 0 ||
-        size < 0 ||
-        count > size ||
-        offset > size - count;
-}
-
-static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
-                                  int64_t sector_num, int nb_sectors)
-{
-    if (sector_num < 0 ||
-        nb_sectors < 0)
-        return 1;
-
-    if (sector_num > bs->total_sectors - nb_sectors) {
-        if (bs->autogrow)
-            bs->total_sectors = sector_num + nb_sectors;
-        else
-            return 1;
-    }
-    return 0;
-}
-
-static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
-                                int64_t offset, int count)
-{
-    int64_t size = bs->total_sectors << SECTOR_BITS;
-    if (count < 0 ||
-        offset < 0)
-        return 1;
-
-    if (offset > size - count) {
-        if (bs->autogrow)
-            bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
-        else
-            return 1;
-    }
-    return 0;
-}
-
 
 static void bdrv_register(BlockDriver *bdrv)
 {
@@ -416,10 +362,6 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
     bs->read_only = 0;
     bs->is_temporary = 0;
     bs->encrypted = 0;
-    bs->autogrow = 0;
-
-    if (flags & BDRV_O_AUTOGROW)
-        bs->autogrow = 1;
 
     if (flags & BDRV_O_SNAPSHOT) {
         BlockDriverState *bs1;
@@ -480,7 +422,6 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
-    bs->total_sectors = 0; /* driver will set if it does not do getlength */
     if (bs->opaque == NULL && drv->instance_size > 0)
         return -1;
     /* Note: for compatibility, we open disk image files as RDWR, and
@@ -551,7 +492,6 @@ void bdrv_close(BlockDriverState *bs)
         bs->drv = NULL;
 
         /* call the change callback */
-        bs->total_sectors = 0;
         bs->media_changed = 1;
         if (bs->change_cb)
             bs->change_cb(bs->change_opaque);
@@ -624,8 +564,6 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num,
     if (!drv)
         return -ENOMEDIUM;
 
-    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-        return -EDOM;
     if (drv->bdrv_pread) {
         int ret, len;
         len = nb_sectors * 512;
@@ -658,8 +596,6 @@ int bdrv_write(BlockDriverState *bs, int64_t sector_num,
         return -ENOMEDIUM;
     if (bs->read_only)
         return -EACCES;
-    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-        return -EDOM;
     if (drv->bdrv_pwrite) {
         int ret, len, count = 0;
         len = nb_sectors * 512;
@@ -783,8 +719,6 @@ int bdrv_pread(BlockDriverState *bs, int64_t offset,
         return -ENOMEDIUM;
     if (!drv->bdrv_pread)
         return bdrv_pread_em(bs, offset, buf1, count1);
-    if (bdrv_rd_badreq_bytes(bs, offset, count1))
-        return -EDOM;
     return drv->bdrv_pread(bs, offset, buf1, count1);
 }
 
@@ -800,8 +734,6 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
         return -ENOMEDIUM;
     if (!drv->bdrv_pwrite)
         return bdrv_pwrite_em(bs, offset, buf1, count1);
-    if (bdrv_wr_badreq_bytes(bs, offset, count1))
-        return -EDOM;
     return drv->bdrv_pwrite(bs, offset, buf1, count1);
 }
 
@@ -1234,8 +1166,6 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
         return -ENOMEDIUM;
     if (!drv->bdrv_write_compressed)
         return -ENOTSUP;
-    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-        return -EDOM;
     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
 }
 
@@ -1382,8 +1312,6 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
 
     if (!drv)
         return NULL;
-    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-        return NULL;
 
     ret = drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);
 
@@ -1407,8 +1335,6 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
         return NULL;
     if (bs->read_only)
         return NULL;
-    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-        return NULL;
 
     ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);
 
diff --git a/qemu/block.h b/qemu/block.h
index 148763a..5ef1cac 100644
--- a/qemu/block.h
+++ b/qemu/block.h
@@ -47,7 +47,6 @@ typedef struct QEMUSnapshotInfo {
 #define BDRV_O_NOCACHE     0x0020 /* do not use the host page cache */
 #define BDRV_O_CACHE_WB    0x0040 /* use write-back caching */
 #define BDRV_O_CACHE_DEF   0x0080 /* use default caching */
-#define BDRV_O_AUTOGROW    0x0100 /* Allow backing file to extend when writing past end of file */
 
 #define BDRV_O_CACHE_MASK  (BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_CACHE_DEF)
 
diff --git a/qemu/block_int.h b/qemu/block_int.h
index 9541b2e..4eaceca 100644
--- a/qemu/block_int.h
+++ b/qemu/block_int.h
@@ -103,7 +103,6 @@ struct BlockDriverState {
     int locked;    /* if true, the media cannot temporarily be ejected */
     int encrypted; /* if true, the media is encrypted */
     int sg;        /* if true, the device is a /dev/sg* */
-    int autogrow;  /* if true, the backing store can auto-extend to allocate new extents */
     /* event callback when inserting/removing */
     void (*change_cb)(void *opaque);
     void *change_opaque;
-- 
1.6.3.rc4.29.g8146