diff options
| author | Stefano Garzarella <sgarzare@redhat.com> | 2021-10-05 18:11:56 +0200 |
|---|---|---|
| committer | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2021-10-05 18:56:20 +0200 |
| commit | 8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf (patch) | |
| tree | 9bc76e1402ddc47d2c6741ff3d226dccfe37d74c /block | |
| parent | 9618c5badaa8eed25259cf095ff880efb939fbe7 (diff) | |
| download | qemu-8fc898ce0b3e7fea8c7c2a8d8977f2a9b77ecebf.zip | |
block/backup: avoid integer overflow of `max-workers`
QAPI generates `struct BackupPerf` where `max-workers` value is stored
in an `int64_t` variable.
But block_copy_async(), and the underlying code, uses an `int` parameter.
At the end that variable is used to initialize `max_busy_tasks` in
block/aio_task.c causing the following assertion failure if a value
greater than INT_MAX(2147483647) is used:
../block/aio_task.c:63: aio_task_pool_wait_one: Assertion `pool->busy_tasks > 0' failed.
Let's check that `max-workers` doesn't exceed INT_MAX and print an
error in that case.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2009310
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20211005161157.282396-2-sgarzare@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/backup.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/block/backup.c b/block/backup.c index 687d2882bc..8b072db5d9 100644 --- a/block/backup.c +++ b/block/backup.c @@ -407,8 +407,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs, return NULL; } - if (perf->max_workers < 1) { - error_setg(errp, "max-workers must be greater than zero"); + if (perf->max_workers < 1 || perf->max_workers > INT_MAX) { + error_setg(errp, "max-workers must be between 1 and %d", INT_MAX); return NULL; } |