Bug 1206987 - virsh blockcopy command option --bandwidth has a overflow issue
Summary: virsh blockcopy command option --bandwidth has a overflow issue
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt
Version: 7.2
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Peter Krempa
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-30 01:31 UTC by Luyao Huang
Modified: 2015-11-19 06:26 UTC (History)
6 users (show)

Fixed In Version: libvirt-1.2.14-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 06:26:07 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2202 0 normal SHIPPED_LIVE libvirt bug fix and enhancement update 2015-11-19 08:17:58 UTC

Description Luyao Huang 2015-03-30 01:31:01 UTC
description of problem:
virsh blockcopy command option --bandwidth has a overflow issue

Version-Release number of selected component (if applicable):
libvirt-1.2.13-1.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1.
[root@lhuang ~]# virsh blockcopy test3 hda --xml gluster.xml --bandwidth 11111111111111
error: internal error: argument key 'speed' must not be negative

[root@lhuang ~]# virsh blockcopy test3 hda --xml gluster.xml --bandwidth 111111111111111
error: internal error: unable to execute QEMU command 'drive-mirror': Could not create file: Permission denied

[root@lhuang ~]# virsh blockcopy test3 hda --xml gluster.xml --bandwidth 1111111111111111
error: internal error: unable to execute QEMU command 'drive-mirror': Could not create file: Permission denied

[root@lhuang ~]# virsh blockcopy test3 hda --xml gluster.xml --bandwidth 11111111111111111
error: internal error: argument key 'speed' must not be negative

Actual results:
virsh blockcopy command option --bandwidth has a overflow issue

Expected results:
report error : bandwidth must be less than...

infomation:

check the code:

miss goto clean up

            if (bandwidth) {
                /* bandwidth is ulong MiB/s, but the typed parameter is
                 * ullong bytes/s; make sure we don't overflow */
                unsigned long long limit = MIN(ULONG_MAX, ULLONG_MAX >> 20);
                if (bandwidth > limit) {
                    virReportError(VIR_ERR_OVERFLOW,
                                   _("bandwidth must be less than %llu"),
                                   ULLONG_MAX >> 20);
                }


Additional info:

I have send a patch to upstream:

http://www.redhat.com/archives/libvir-list/2015-March/msg01428.html

Comment 1 Peter Krempa 2015-03-30 14:49:22 UTC
Fixed upstream:

commit 390f218b83513a00b81549eb66854d8b263cb014
Author: Luyao Huang <lhuang@redhat.com>
Date:   Fri Mar 27 17:56:29 2015 +0800

    virsh: blockCopy: Add missing jump on error path
    
    The overflow check for the bandwidth parameter did not jump to the
    cleanup label.
    
    Additionally virsh should use vshError instead of virReportError.

v1.2.14-rc1-13-g390f218

Comment 3 Shanzhi Yu 2015-06-16 03:39:47 UTC
Verify this bug with libvirt-1.2.16-1.el7.x86_64

Comment 5 errata-xmlrpc 2015-11-19 06:26:07 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2202.html


Note You need to log in before you can comment on or make changes to this bug.