On Fri, 23 Oct 2020 at 16:22, Stefan Hajnoczi <stefa...@redhat.com> wrote:
>
> From: Coiby Xu <coiby...@gmail.com>
>
> By making use of libvhost-user, block device drive can be shared to
> the connected vhost-user client. Only one client can connect to the
> server one time.
>
> Since vhost-user-server needs a block drive to be created first, delay
> the creation of this object.
Hi; Coverity points out a possible bug in this function
(CID 1435956):
> +static int coroutine_fn
> +vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
> + uint32_t iovcnt, uint32_t type)
> +{
> + struct virtio_blk_discard_write_zeroes desc;
> + ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
> + if (unlikely(size != sizeof(desc))) {
> + error_report("Invalid size %zd, expect %zu", size, sizeof(desc));
> + return -EINVAL;
> + }
> +
> + VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
> + uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
> + le32_to_cpu(desc.num_sectors) << 9 };
Here we get a 32-bit integer from desc.num_sectors, and then the
shift left might make it overflow the 32-bit value before it gets
put into a uint64_t in the range array. Should this be
(uint64_t)le32_to_cpu(desc.num_sectors) << 9
?
thanks
-- PMM
