From: Dmitry Frolov Date: Wed, 13 Nov 2024 14:05:01 +0000 (+0300) Subject: migration: fix-possible-int-overflow X-Git-Tag: v9.2.0-rc1~11^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0926c002c7c71749a781de13f28b0481e029d323;p=thirdparty%2Fqemu.git migration: fix-possible-int-overflow stat64_add() takes uint64_t as 2nd argument, but both "p->next_packet_size" and "p->packet_len" are uint32_t. Thus, theyr sum may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov Link: https://lore.kernel.org/r/20241113140509.325732-2-frolov@swemel.ru Signed-off-by: Peter Xu --- diff --git a/migration/multifd.c b/migration/multifd.c index 4374e14a965..498e71fd102 100644 --- a/migration/multifd.c +++ b/migration/multifd.c @@ -623,7 +623,7 @@ static void *multifd_send_thread(void *opaque) } stat64_add(&mig_stats.multifd_bytes, - p->next_packet_size + p->packet_len); + (uint64_t)p->next_packet_size + p->packet_len); p->next_packet_size = 0; multifd_set_payload_type(p->data, MULTIFD_PAYLOAD_NONE);