36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
|
From 254c67a88ab54fdfe1eb55d7efaf4386a9597cd0 Mon Sep 17 00:00:00 2001
|
||
|
|
From: tangzhongrui <tangzhongrui@cmss.chinamobile.com>
|
||
|
|
Date: Sat, 16 Nov 2024 17:38:50 +0800
|
||
|
|
Subject: [PATCH] migration: fix-possible-int-overflow
|
||
|
|
|
||
|
|
stat64_add() takes uint64_t as 2nd argument, but both
|
||
|
|
"p->next_packet_size" and "p->packet_len" are uint32_t.
|
||
|
|
Thus, theyr sum may overflow uint32_t.
|
||
|
|
|
||
|
|
Found by Linux Verification Center (linuxtesting.org) with SVACE.
|
||
|
|
|
||
|
|
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
|
||
|
|
Link: https://lore.kernel.org/r/20241113140509.325732-2-frolov@swemel.ru
|
||
|
|
Signed-off-by: Peter Xu <peterx@redhat.com>
|
||
|
|
Signed-off-by: Zhongrui Tang <tangzhongrui_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
migration/multifd.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/migration/multifd.c b/migration/multifd.c
|
||
|
|
index 7d373a245e..f3bf6888c0 100644
|
||
|
|
--- a/migration/multifd.c
|
||
|
|
+++ b/migration/multifd.c
|
||
|
|
@@ -735,7 +735,7 @@ static void *multifd_send_thread(void *opaque)
|
||
|
|
}
|
||
|
|
|
||
|
|
stat64_add(&mig_stats.multifd_bytes,
|
||
|
|
- p->next_packet_size + p->packet_len);
|
||
|
|
+ (uint64_t)p->next_packet_size + p->packet_len);
|
||
|
|
p->next_packet_size = 0;
|
||
|
|
qemu_mutex_lock(&p->mutex);
|
||
|
|
p->pending_job--;
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|