memfd: Avoid Coverity warning about integer overflow

Message ID 20180515172729.24564-1-peter.maydell@linaro.org
State Superseded
Headers show
Series
  • memfd: Avoid Coverity warning about integer overflow
Related show

Commit Message

Peter Maydell May 15, 2018, 5:27 p.m.
Coverity complains about qemu_memfd_create() (CID 1385858) because
we calculate a bit position htsize which could be up to 63, but
then use it in "1 << htsize" which is a 32-bit integer calculation
and could push the 1 off the top of the value.

Silence the complaint bu using "1ULL"; this isn't a bug in
practice since a hugetlbsize of 4GB is not very plausible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---
 util/memfd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.17.0

Comments

Marc-André Lureau May 15, 2018, 6:14 p.m. | #1
On Tue, May 15, 2018 at 7:27 PM, Peter Maydell <peter.maydell@linaro.org> wrote:
> Coverity complains about qemu_memfd_create() (CID 1385858) because

> we calculate a bit position htsize which could be up to 63, but

> then use it in "1 << htsize" which is a 32-bit integer calculation

> and could push the 1 off the top of the value.

>

> Silence the complaint bu using "1ULL"; this isn't a bug in

> practice since a hugetlbsize of 4GB is not very plausible.

>

> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Thanks Peter for the fix,

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>


> ---

>  util/memfd.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

>

> diff --git a/util/memfd.c b/util/memfd.c

> index b3ecbac19e..d248a53c3c 100644

> --- a/util/memfd.c

> +++ b/util/memfd.c

> @@ -66,7 +66,7 @@ int qemu_memfd_create(const char *name, size_t size, bool hugetlb,

>  {

>      int htsize = hugetlbsize ? ctz64(hugetlbsize) : 0;

>

> -    if (htsize && 1 << htsize != hugetlbsize) {

> +    if (htsize && 1ULL << htsize != hugetlbsize) {

>          error_setg(errp, "Hugepage size must be a power of 2");

>          return -1;

>      }

> --

> 2.17.0

>

>




-- 
Marc-André Lureau
Alex Bennée May 15, 2018, 7:27 p.m. | #2
Peter Maydell <peter.maydell@linaro.org> writes:

> Coverity complains about qemu_memfd_create() (CID 1385858) because

> we calculate a bit position htsize which could be up to 63, but

> then use it in "1 << htsize" which is a 32-bit integer calculation

> and could push the 1 off the top of the value.

>

> Silence the complaint bu using "1ULL"; this isn't a bug in

> practice since a hugetlbsize of 4GB is not very plausible.

>

> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Reviewed-by: Alex Bennée <alex.bennee@linaro.org>


> ---

>  util/memfd.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

>

> diff --git a/util/memfd.c b/util/memfd.c

> index b3ecbac19e..d248a53c3c 100644

> --- a/util/memfd.c

> +++ b/util/memfd.c

> @@ -66,7 +66,7 @@ int qemu_memfd_create(const char *name, size_t size, bool hugetlb,

>  {

>      int htsize = hugetlbsize ? ctz64(hugetlbsize) : 0;

>

> -    if (htsize && 1 << htsize != hugetlbsize) {

> +    if (htsize && 1ULL << htsize != hugetlbsize) {

>          error_setg(errp, "Hugepage size must be a power of 2");

>          return -1;

>      }



--
Alex Bennée
Paolo Bonzini May 16, 2018, 7:23 a.m. | #3
On 15/05/2018 19:27, Peter Maydell wrote:
> Coverity complains about qemu_memfd_create() (CID 1385858) because

> we calculate a bit position htsize which could be up to 63, but

> then use it in "1 << htsize" which is a 32-bit integer calculation

> and could push the 1 off the top of the value.

> 

> Silence the complaint bu using "1ULL"; this isn't a bug in

> practice since a hugetlbsize of 4GB is not very plausible.

> 

> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

> ---

>  util/memfd.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

> 

> diff --git a/util/memfd.c b/util/memfd.c

> index b3ecbac19e..d248a53c3c 100644

> --- a/util/memfd.c

> +++ b/util/memfd.c

> @@ -66,7 +66,7 @@ int qemu_memfd_create(const char *name, size_t size, bool hugetlb,

>  {

>      int htsize = hugetlbsize ? ctz64(hugetlbsize) : 0;

>  

> -    if (htsize && 1 << htsize != hugetlbsize) {

> +    if (htsize && 1ULL << htsize != hugetlbsize) {

>          error_setg(errp, "Hugepage size must be a power of 2");

>          return -1;

>      }

> 


Queued, thanks.

Paolo

Patch

diff --git a/util/memfd.c b/util/memfd.c
index b3ecbac19e..d248a53c3c 100644
--- a/util/memfd.c
+++ b/util/memfd.c
@@ -66,7 +66,7 @@  int qemu_memfd_create(const char *name, size_t size, bool hugetlb,
 {
     int htsize = hugetlbsize ? ctz64(hugetlbsize) : 0;
 
-    if (htsize && 1 << htsize != hugetlbsize) {
+    if (htsize && 1ULL << htsize != hugetlbsize) {
         error_setg(errp, "Hugepage size must be a power of 2");
         return -1;
     }