From: Dmitry Frolov <frolov@swemel.ru>
Date: Tue, 17 Sep 2024 08:03:18 +0000 (+0300)
Subject: hw/block: fix uint32 overflow
X-Git-Tag: v9.2.0-rc0~81^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=89cd6254b80784a1b3f574407192493ef92fe65f;p=thirdparty%2Fqemu.git

hw/block: fix uint32 overflow

The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow
uint32.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-id: 20240917080356.270576-2-frolov@swemel.ru
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 73bdfd6122a..115795392c4 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -700,7 +700,7 @@ static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op)
     } else {
         if (bs->bl.zone_size > capacity - offset) {
             /* The zoned device allows the last smaller zone. */
-            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1);
+            len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1ull);
         } else {
             len = bs->bl.zone_size;
         }