From f80009632f2b781632352db9326cd2490b7c37f2 Mon Sep 17 00:00:00 2001
From: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Date: Mon, 9 Jan 2023 09:56:42 +0100
Subject: [PATCH] nvmf/vfio_user: cast `numdw` to uint32_t

Use uint32_t to avoid overflow when left shift by 16 places

This patch fix issue #2858

Signed-off-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Change-Id: I07f4328674ae7bd7525792ca1e424e85a932c87f
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/16180
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
Reviewed-by: Changpeng Liu <changpeng.liu@intel.com>
Reviewed-by: Shuhei Matsumoto <smatsumoto@nvidia.com>
Reviewed-by: Konrad Sztyber <konrad.sztyber@intel.com>
---
 lib/nvmf/vfio_user.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/nvmf/vfio_user.c b/lib/nvmf/vfio_user.c
index d95ae6660..c6c2b0d40 100644
--- a/lib/nvmf/vfio_user.c
+++ b/lib/nvmf/vfio_user.c
@@ -5367,7 +5367,8 @@ map_admin_cmd_req(struct nvmf_vfio_user_ctrlr *ctrlr, struct spdk_nvmf_request *
 		len = 4096;
 		break;
 	case SPDK_NVME_OPC_GET_LOG_PAGE:
-		numdw = (((cmd->cdw11_bits.get_log_page.numdu << 16) | cmd->cdw10_bits.get_log_page.numdl) + 1);
+		numdw = ((((uint32_t)cmd->cdw11_bits.get_log_page.numdu << 16) |
+			  cmd->cdw10_bits.get_log_page.numdl) + 1);
 		if (numdw > UINT32_MAX / 4) {
 			return -EINVAL;
 		}