* [Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
@ 2015-03-14 16:00 Stefan Weil
2015-03-23 11:51 ` Stefan Hajnoczi
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Weil @ 2015-03-14 16:00 UTC (permalink / raw)
To: QEMU Developer; +Cc: Keith Busch, Kevin Wolf, Stefan Hajnoczi, Stefan Weil
The shift operation on nlb gives a 32 bit result if no type cast is
applied. This bug was reported by Coverity.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
hw/block/nvme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 0f3dfb9..1e07166 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -222,7 +222,7 @@ static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,
uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);
uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;
- uint64_t data_size = nlb << data_shift;
+ uint64_t data_size = (uint64_t)nlb << data_shift;
uint64_t aio_slba = slba << (data_shift - BDRV_SECTOR_BITS);
int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
2015-03-14 16:00 [Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN) Stefan Weil
@ 2015-03-23 11:51 ` Stefan Hajnoczi
0 siblings, 0 replies; 2+ messages in thread
From: Stefan Hajnoczi @ 2015-03-23 11:51 UTC (permalink / raw)
To: Stefan Weil; +Cc: Keith Busch, Kevin Wolf, QEMU Developer, Stefan Hajnoczi
[-- Attachment #1: Type: text/plain, Size: 413 bytes --]
On Sat, Mar 14, 2015 at 05:00:44PM +0100, Stefan Weil wrote:
> The shift operation on nlb gives a 32 bit result if no type cast is
> applied. This bug was reported by Coverity.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
> hw/block/nvme.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block
Stefan
[-- Attachment #2: Type: application/pgp-signature, Size: 473 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-03-23 11:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-03-14 16:00 [Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN) Stefan Weil
2015-03-23 11:51 ` Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).