OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

migration/rdma: Fix unwanted integer truncation

Browse Source 
qio_channel_rdma_readv() assigns the size_t value of qemu_rdma_fill()
to an int variable before it adds it to @done / subtracts it from
@want, both size_t.  Truncation when qemu_rdma_fill() copies more than
INT_MAX bytes.  Seems vanishingly unlikely, but needs fixing all the
same.

Fixes: 6ddd2d76ca (migration: convert RDMA to use QIOChannel interface)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230928132019.2544702-7-armbru@redhat.com>
This commit is contained in:
Markus Armbruster 2023-09-28 15:19:32 +02:00 committed by Juan Quintela
parent 87a24ca3f2
commit 25352b371b
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
migration/rdma.c
View File

@ -2871,7 +2871,7 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
RDMAControlHeader head;
int ret = 0;
ssize_t i;
size_t done = 0;
size_t done = 0, len;
RCU_READ_LOCK_GUARD();
rdma = qatomic_rcu_read(&rioc->rdmain);
@ -2892,9 +2892,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
* were given and dish out the bytes until we run
* out of bytes.
*/
ret = qemu_rdma_fill(rdma, data, want, 0);
done += ret;
want -= ret;
len = qemu_rdma_fill(rdma, data, want, 0);
done += len;
want -= len;
/* Got what we needed, so go to next iovec */
if (want == 0) {
continue;
@ -2921,9 +2921,9 @@ static ssize_t qio_channel_rdma_readv(QIOChannel *ioc,
/*
* SEND was received with new bytes, now try again.
*/
ret = qemu_rdma_fill(rdma, data, want, 0);
done += ret;
want -= ret;
len = qemu_rdma_fill(rdma, data, want, 0);
done += len;
want -= len;
/* Still didn't get enough, so lets just return */
if (want) {