@samitouri / QOSamiQemu / commits / 0d3db94a88

block/cloop: fix integer overflow in total_sectors calculation

The total_sectors is computed as n_blocks * sectors_per_block where both operands are uint32_t. The multiplication is performed in 32-bit arithmetic and can overflow when the product exceeds UINT32_MAX, producing a value much smaller than the true image size. The result is assigned to int64_t total_sectors but the 32-bit multiplication has already wrapped around, and the zero-extension to 64-bit does not recover the correct value. This causes the block layer to reject valid I/O requests (DoS) when the reported total_sectors is smaller than the actual image. Use 64-bit arithmetic by casting one operand to uint64_t so the multiplication is performed in 64-bit precision. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3972 Signed-off-by: Ma Like <malike@kylinos.cn> Message-ID: <20260713031750.58448-1-malike@kylinos.cn> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

malike committed Jul 13, 2026 at 11:17 UTC 0d3db94a886610c5923e52cc23f841ccb9cb546c

1 file changed +2 -1

block/cloop.c

+2 -1

@@ -202,7 +202,8 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,

202 s->current_block = s->n_blocks;

203

204 s->sectors_per_block = s->block_size/512;

205 - bs->total_sectors = s->n_blocks * s->sectors_per_block;

205 + /* Cast to uint64_t to prevent uint32_t overflow */

206 + bs->total_sectors = (uint64_t)s->n_blocks * s->sectors_per_block;

207 qemu_co_mutex_init(&s->lock);

208 return 0;

209