fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask

Browse source 
In gen_mcrfs() the FPSCR nibble mask is computed as:
      `~((0xF << shift) & FP_EX_CLEAR_BITS)`

Here, 0xF is of type int, so the left shift is performed in
32-bit signed arithmetic. For bfa=0 we get shift=28,
and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit
signed int. Static analyzers flag this as a potential integer
overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Sergeev <zeff@altlinux.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250915080118.29898-1-zeff@altlinux.org
Message-ID: <20250915080118.29898-1-zeff@altlinux.org>
This commit is contained in:
Denis Sergeev 2025-09-15 11:01:18 +03:00 • committed by Harsh Prateek Bora
parent 264a604e71
commit 6c51df580d
No known key found for this signature in database
GPG key ID: 4544E994F9D68FBB
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
target/ppc/translate/fp-impl.c.inc
View file

@ -396,7 +396,7 @@ static void gen_mcrfs(DisasContext *ctx)
tcg_gen_extu_tl_i64(tnew_fpscr, cpu_fpscr);
/* Only the exception bits (including FX) should be cleared if read */
tcg_gen_andi_i64(tnew_fpscr, tnew_fpscr,
~((0xF << shift) & FP_EX_CLEAR_BITS));
~(MAKE_64BIT_MASK(shift, 4) & FP_EX_CLEAR_BITS));
/* FEX and VX need to be updated, so don't set fpscr directly */
tmask = tcg_constant_i32(1 << nibble);
gen_helper_store_fpscr(tcg_env, tnew_fpscr, tmask);