[Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

[Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

[Stefan Weil]

The shift operation on nlb gives a 32 bit result if no type cast is
applied. This bug was reported by Coverity.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
 hw/block/nvme.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 0f3dfb9..1e07166 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -222,7 +222,7 @@ static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,
 
     uint8_t lba_index  = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);
     uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;
-    uint64_t data_size = nlb << data_shift;
+    uint64_t data_size = (uint64_t)nlb << data_shift;
     uint64_t aio_slba  = slba << (data_shift - BDRV_SECTOR_BITS);
     int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;
 
-- 
1.7.10.4

Re: [Qemu-devel] [PATCH] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 413 bytes --]

On Sat, Mar 14, 2015 at 05:00:44PM +0100, Stefan Weil wrote:
> The shift operation on nlb gives a 32 bit result if no type cast is
> applied. This bug was reported by Coverity.
> 
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
>  hw/block/nvme.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan

[-- Attachment #2: Type: application/pgp-signature, Size: 473 bytes --]