diff options
| author | Markus Armbruster <armbru@redhat.com> | 2023-09-28 15:19:32 +0200 |
|---|---|---|
| committer | Juan Quintela <quintela@redhat.com> | 2023-10-11 11:17:03 +0200 |
| commit | 25352b371b37b038d50b75ec0a3557e77f1d74e3 (patch) | |
| tree | 213ee700c3243880de055a13feabca553b19c5a1 /migration/rdma.c | |
| parent | 87a24ca3f2054d1b3268ceb141751a1fff32cc9c (diff) | |
| download | focaccia-qemu-25352b371b37b038d50b75ec0a3557e77f1d74e3.tar.gz focaccia-qemu-25352b371b37b038d50b75ec0a3557e77f1d74e3.zip | |
migration/rdma: Fix unwanted integer truncation
qio_channel_rdma_readv() assigns the size_t value of qemu_rdma_fill() to an int variable before it adds it to @done / subtracts it from @want, both size_t. Truncation when qemu_rdma_fill() copies more than INT_MAX bytes. Seems vanishingly unlikely, but needs fixing all the same. Fixes: 6ddd2d76ca6f (migration: convert RDMA to use QIOChannel interface) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> Message-ID: <20230928132019.2544702-7-armbru@redhat.com>
Diffstat (limited to 'migration/rdma.c')
| -rw-r--r-- | migration/rdma.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/migration/rdma.c b/migration/rdma.c index d1e727f30b..ff8e475f59 100644 --- a/migration/rdma.c +++ b/migration/rdma.c @@ -2871,7 +2871,7 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc, RDMAControlHeader head; int ret = 0; ssize_t i; - size_t done = 0; + size_t done = 0, len; RCU_READ_LOCK_GUARD(); rdma = qatomic_rcu_read(&rioc->rdmain); @@ -2892,9 +2892,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc, * were given and dish out the bytes until we run * out of bytes. */ - ret = qemu_rdma_fill(rdma, data, want, 0); - done += ret; - want -= ret; + len = qemu_rdma_fill(rdma, data, want, 0); + done += len; + want -= len; /* Got what we needed, so go to next iovec */ if (want == 0) { continue; @@ -2921,9 +2921,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc, /* * SEND was received with new bytes, now try again. */ - ret = qemu_rdma_fill(rdma, data, want, 0); - done += ret; - want -= ret; + len = qemu_rdma_fill(rdma, data, want, 0); + done += len; + want -= len; /* Still didn't get enough, so lets just return */ if (want) { |