Commit 4fcefd44 authored by Peter Xu's avatar Peter Xu Committed by Dr. David Alan Gilbert
Browse files

migration: fix potential overflow in multifd send 



I would guess it won't happen normally, but this should ease Coverity.

>>>     CID 1394385:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "pages->used * 8192U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "uint64_t" (64 bits, unsigned).
854         transferred = pages->used * TARGET_PAGE_SIZE + p->packet_len;

Fixes: CID 1394385
CC: Juan Quintela <quintela@redhat.com>
Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
Message-Id: <20180720034713.11711-1-peterx@redhat.com>
Reviewed-by: default avatarJuan Quintela <quintela@redhat.com>
Signed-off-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
parent 3bae1504

migration/ram.c

+1 −1
Original line number Diff line number Diff line
@@ -851,7 +851,7 @@ static void multifd_send_pages(void) 
    p->pages->block = NULL;

    multifd_send_state->pages = p->pages;

    p->pages = pages;

    transferred = pages->used * TARGET_PAGE_SIZE + p->packet_len;

    transferred = ((uint64_t) pages->used) * TARGET_PAGE_SIZE + p->packet_len;

    ram_counters.multifd_bytes += transferred;

    ram_counters.transferred += transferred;;

    qemu_mutex_unlock(&p->mutex);