hw/block/nvme: fix potential overflow
page_size is a uint32_t, and zasl is a uint8_t, so the expression
`page_size << zasl` is done using 32-bit arithmetic and might overflow.
Since we then compare this against a 64 bit data_size value, Coverity
complains that we might overflow unintentionally. An MDTS/ZASL value in
excess of 4GiB is probably impractical, but it is not entirely
unrealistic, so add a cast such that we handle that case properly.
Fixes: 578d914b26
("hw/block/nvme: align zoned.zasl with mdts")
Fixes: CID 1450756
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
This commit is contained in:
parent
b12498fc57
commit
9c62f1efa8
|
@ -2188,7 +2188,8 @@ static uint16_t nvme_do_write(NvmeCtrl *n, NvmeRequest *req, bool append,
|
||||||
goto invalid;
|
goto invalid;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (n->params.zasl && data_size > n->page_size << n->params.zasl) {
|
if (n->params.zasl &&
|
||||||
|
data_size > (uint64_t)n->page_size << n->params.zasl) {
|
||||||
trace_pci_nvme_err_zasl(data_size);
|
trace_pci_nvme_err_zasl(data_size);
|
||||||
return NVME_INVALID_FIELD | NVME_DNR;
|
return NVME_INVALID_FIELD | NVME_DNR;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue