From 89cd6254b80784a1b3f574407192493ef92fe65f Mon Sep 17 00:00:00 2001 From: Dmitry Frolov Date: Tue, 17 Sep 2024 11:03:18 +0300 Subject: [PATCH] hw/block: fix uint32 overflow The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow uint32. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov Message-id: 20240917080356.270576-2-frolov@swemel.ru Signed-off-by: Stefan Hajnoczi --- hw/block/virtio-blk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 73bdfd6122..115795392c 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -700,7 +700,7 @@ static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op) } else { if (bs->bl.zone_size > capacity - offset) { /* The zoned device allows the last smaller zone. */ - len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1); + len = capacity - bs->bl.zone_size * (bs->bl.nr_zones - 1ull); } else { len = bs->bl.zone_size; }