Re: [PULL v2 0/9] parallels: fix reachable assertion and related bounds-checking gaps

On 7/28/26 18:38, Denis V. Lunev wrote:
> The following changes since commit 6333226c2abb72f31648c251624c56e70993d625:
> 
>    Merge tag 'pull-9p-20260725' of https://github.com/cschoenebeck/qemu into staging (2026-07-26 08:30:07 -0400)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/dlunev/qemu.git tags/pull-parallels-2026-07-28
> 
> for you to fetch changes up to 352587cbe2d4cde1cece16e2f6a9e1e4190a03e6:
> 
>    MAINTAINERS: update parallels tree location (2026-07-28 16:55:00 +0200)
> 
> ----------------------------------------------------------------
> Parallels block driver patches
> 
> - fix a reachable assert()/process abort on a crafted image with an
>    inconsistent BAT vs. advertised disk size (GitLab #3804)
> - fix related integer overflows capping the format's usable catalog
>    size below its documented maximum
> - reject BAT entries pointing outside the data area in either
>    direction
> - harden the dirty-bitmap extension loader against a reachable
>    abort and an unsafe allocator
> 
> Changes since v1:
> 
> - filter out format specific info in patches 2,8
> 
> Signed-off-by: Denis V. Lunev <[email protected]>
> CC: Thomas Huth <[email protected]>
> CC: Stefan Hajnoczi <[email protected]>
> 
> ----------------------------------------------------------------
> Denis V. Lunev (9):
>    parallels: fix integer overflow in header size calculation
>    parallels: read header/BAT table in bounded chunks
>    parallels: fix bat_entries overflow in image creation
>    parallels: reject BAT entries pointing outside backed storage
>    parallels: validate bitmap L1 table size before allocating it
>    parallels: skip loading a genuinely empty bitmap L1 table
>    parallels: avoid fatal abort on large bitmap L1 table
>    parallels: validate BAT capacity against advertised disk size
>    MAINTAINERS: update parallels tree location

Hi Denis!

This is a bugfix pull request.  Is it worth to pick it up for
the stable series, or is parallels not used much outside of
openvz (which sure uses locally patched qemu)?

Thanks,

/mjt