motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-17 23:22:12 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

migration/rdma: Fix unwanted integer truncation

Browse source 
qio_channel_rdma_readv() assigns the size_t value of qemu_rdma_fill()
to an int variable before it adds it to @done / subtracts it from
@want, both size_t.  Truncation when qemu_rdma_fill() copies more than
INT_MAX bytes.  Seems vanishingly unlikely, but needs fixing all the
same.

Fixes: 6ddd2d76ca (migration: convert RDMA to use QIOChannel interface)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230928132019.2544702-7-armbru@redhat.com>
This commit is contained in:
Markus Armbruster 2023-09-28 15:19:32 +02:00 • committed by Juan Quintela
parent 87a24ca3f2
commit 25352b371b
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
migration/rdma.c
View file

@ -2871,7 +2871,7 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
RDMAControlHeader head; RDMAControlHeader head;
int ret = 0; int ret = 0;
ssize_t i; ssize_t i;
size_t done = 0; size_t done = 0, len;
RCU_READ_LOCK_GUARD(); RCU_READ_LOCK_GUARD();
rdma = qatomic_rcu_read(&rioc->rdmain); rdma = qatomic_rcu_read(&rioc->rdmain);
@ -2892,9 +2892,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
* were given and dish out the bytes until we run * were given and dish out the bytes until we run
* out of bytes. * out of bytes.
*/ */
ret = qemu_rdma_fill(rdma, data, want, 0); len = qemu_rdma_fill(rdma, data, want, 0);
done += ret; done += len;
want -= ret; want -= len;
/* Got what we needed, so go to next iovec */ /* Got what we needed, so go to next iovec */
if (want == 0) { if (want == 0) {
continue; continue;
@ -2921,9 +2921,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
/* /*
* SEND was received with new bytes, now try again. * SEND was received with new bytes, now try again.
*/ */
ret = qemu_rdma_fill(rdma, data, want, 0); len = qemu_rdma_fill(rdma, data, want, 0);
done += ret; done += len;
want -= ret; want -= len;
/* Still didn't get enough, so lets just return */ /* Still didn't get enough, so lets just return */
if (want) { if (want) {