Bug 1166496

Summary: qemu-img: Assert for 'amend -o compat=0.10' command on the fuzzed image
Product: Red Hat Enterprise Linux 7 Reporter: Sibiao Luo <sluo>
Component: qemu-kvmAssignee: Kevin Wolf <kwolf>
Status: CLOSED WONTFIX QA Contact: Virtualization Bugs <virt-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 7.1CC: chayang, famz, hhuang, hreitz, juzhang, kwolf, michen, pbonzini, qzhang, rbalakri, virt-bugs, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1161393 Environment:
Last Closed: 2014-11-25 12:52:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1161393    
Bug Blocks:    

Comment 1 Sibiao Luo 2014-11-21 05:30:32 UTC
host info:
# uname -r && rpm -q qemu-kvm
3.10.0-205.el7.x86_64
qemu-kvm-1.5.3-79.el7.x86_64

# qemu-img amend -o compat=0.10 -f qcow2 copy.img
qemu-img: block/qcow2-cluster.c:1552: expand_zero_clusters_in_l1: Assertion `(cluster_index >= 0) && (cluster_index < *nb_clusters)' failed.
Aborted (core dumped)

(gdb) bt
#0  0x00007f8b53b555d7 in raise () from /lib64/libc.so.6
#1  0x00007f8b53b56cc8 in abort () from /lib64/libc.so.6
#2  0x00007f8b53b4e546 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007f8b53b4e5f2 in __assert_fail () from /lib64/libc.so.6
#4  0x00007f8b55b1d1eb in expand_zero_clusters_in_l1 (bs=bs@entry=0x7f8b578e3400, l1_table=<optimized out>, 
    l1_size=<optimized out>, expanded_clusters=expanded_clusters@entry=0x7fff5a23cd70, 
    nb_clusters=nb_clusters@entry=0x7fff5a23cd68) at block/qcow2-cluster.c:1552
#5  0x00007f8b55b1eff9 in qcow2_expand_zero_clusters (bs=bs@entry=0x7f8b578e3400) at block/qcow2-cluster.c:1699
#6  0x00007f8b55b25a28 in qcow2_downgrade (target_version=2, bs=0x7f8b578e3400) at block/qcow2.c:2137
#7  qcow2_amend_options (bs=0x7f8b578e3400, options=<optimized out>) at block/qcow2.c:2221
#8  0x00007f8b55b5ca10 in img_amend (argc=<optimized out>, argv=<optimized out>) at qemu-img.c:2754
#9  0x00007f8b53b41af5 in __libc_start_main () from /lib64/libc.so.6
#10 0x00007f8b55b08c2d in _start ()
(gdb)

Comment 2 Kevin Wolf 2014-11-25 12:52:25 UTC
Fixed in upstream as of commit ecf58777. Corner case bug with too invasive fix
to backport it, not worth fixing in qemu-kvm.