diff mbox

nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

Message ID 1426348844-8793-1-git-send-email-sw@weilnetz.de
State Accepted
Headers show

Commit Message

Stefan Weil March 14, 2015, 4 p.m. UTC 
The shift operation on nlb gives a 32 bit result if no type cast is
applied. This bug was reported by Coverity.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
 hw/block/nvme.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Stefan Hajnoczi March 23, 2015, 11:51 a.m. UTC | #1 
On Sat, Mar 14, 2015 at 05:00:44PM +0100, Stefan Weil wrote:
> The shift operation on nlb gives a 32 bit result if no type cast is
> applied. This bug was reported by Coverity.
> 
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
>  hw/block/nvme.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan
diff mbox

Patch

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 0f3dfb9..1e07166 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -222,7 +222,7 @@  static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,
 
     uint8_t lba_index  = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);
     uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;
-    uint64_t data_size = nlb << data_shift;
+    uint64_t data_size = (uint64_t)nlb << data_shift;
     uint64_t aio_slba  = slba << (data_shift - BDRV_SECTOR_BITS);
     int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;