From: David Gibson Date: Wed, 6 Mar 2019 03:15:26 +0000 (+1100) Subject: spapr: Force SPAPR_MEMORY_BLOCK_SIZE to be a hwaddr (64-bit) X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=e075623aa517b0690ec978772df008d7e00ebce5;p=qemu.git spapr: Force SPAPR_MEMORY_BLOCK_SIZE to be a hwaddr (64-bit) SPAPR_MEMORY_BLOCK_SIZE is logically a difference in memory addresses, and hence of type hwaddr which is 64-bit. Previously it wasn't marked as such which means that it could be treated as 32-bit. That will work in some circumstances but if multiplied by another 32-bit value it could lead to a 32-bit overflow and an incorrect result. One specific instance of this in spapr_lmb_dt_populate() was spotted by Coverity (CID 1399145). Reported-by: Peter Maydell Signed-off-by: David Gibson --- diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h index ff1bd60615..1311ebe28e 100644 --- a/include/hw/ppc/spapr.h +++ b/include/hw/ppc/spapr.h @@ -792,7 +792,7 @@ int spapr_rtc_import_offset(sPAPRRTCState *rtc, int64_t legacy_offset); #define TYPE_SPAPR_RNG "spapr-rng" -#define SPAPR_MEMORY_BLOCK_SIZE (1 << 28) /* 256MB */ +#define SPAPR_MEMORY_BLOCK_SIZE ((hwaddr)1 << 28) /* 256MB */ /* * This defines the maximum number of DIMM slots we can have for sPAPR