From: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
To: Paolo Bonzini <pbonzini@redhat.com>,
Alexey Kardashevskiy <aik@ozlabs.ru>,
KONRAD Frederic <frederic.konrad@adacore.com>
Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org>, qemu-devel@nongnu.org
Subject: [Qemu-devel] [NOTFORMERGE PATCH v2 2/4] memory: Fix access_with_adjusted_size() when size < access_size_min
Date: Wed, 4 Apr 2018 22:22:39 -0300 [thread overview]
Message-ID: <20180405012241.25714-3-f4bug@amsat.org> (raw)
In-Reply-To: <20180405012241.25714-1-f4bug@amsat.org>
ASan reported:
shift exponent 4294967280 is too large for 64-bit type 'long unsigned int'
...
runtime error: shift exponent -16 is negative
This can occurs when MemoryRegionOps .valid.min_access_size < .impl.min_access_size,
for example if a guest uses a 16-bit operand to access a 32-bit register.
The current code is limited to right shifting.
Use a signed shift, to allow shifting left when the value is negative.
Reported-by: AddressSanitizer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
memory.c | 74 +++++++++++++++++++++++++++++++++++++++++++++-------------------
1 file changed, 52 insertions(+), 22 deletions(-)
diff --git a/memory.c b/memory.c
index 51d27b7b26..e77f9e4036 100644
--- a/memory.c
+++ b/memory.c
@@ -404,7 +404,7 @@ static MemTxResult memory_region_oldmmio_read_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
@@ -422,7 +422,11 @@ static MemTxResult memory_region_oldmmio_read_accessor(MemoryRegion *mr,
hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
}
- *value |= (tmp & mask) << shift;
+ if (likely(shift >= 0)) {
+ *value |= (tmp & mask) << shift;
+ } else {
+ *value |= (tmp >> -shift) & mask;
+ }
return MEMTX_OK;
}
@@ -430,7 +434,7 @@ static MemTxResult memory_region_read_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
@@ -448,7 +452,11 @@ static MemTxResult memory_region_read_accessor(MemoryRegion *mr,
hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
}
- *value |= (tmp & mask) << shift;
+ if (likely(shift >= 0)) {
+ *value |= (tmp & mask) << shift;
+ } else {
+ *value |= (tmp >> -shift) & mask;
+ }
return MEMTX_OK;
}
@@ -456,7 +464,7 @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
@@ -475,7 +483,11 @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr,
hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);
trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);
}
- *value |= (tmp & mask) << shift;
+ if (likely(shift >= 0)) {
+ *value |= (tmp & mask) << shift;
+ } else {
+ *value |= (tmp >> -shift) & mask;
+ }
return r;
}
@@ -483,13 +495,17 @@ static MemTxResult memory_region_oldmmio_write_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
uint64_t tmp;
- tmp = (*value >> shift) & mask;
+ if (likely(shift >= 0)) {
+ tmp = (*value >> shift) & mask;
+ } else {
+ tmp = (*value & mask) << -shift;
+ }
if (mr->subpage) {
trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
} else if (mr == &io_mem_notdirty) {
@@ -509,13 +525,17 @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
uint64_t tmp;
- tmp = (*value >> shift) & mask;
+ if (likely(shift >= 0)) {
+ tmp = (*value >> shift) & mask;
+ } else {
+ tmp = (*value & mask) << -shift;
+ }
if (mr->subpage) {
trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
} else if (mr == &io_mem_notdirty) {
@@ -535,13 +555,17 @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs)
{
uint64_t tmp;
- tmp = (*value >> shift) & mask;
+ if (likely(shift >= 0)) {
+ tmp = (*value >> shift) & mask;
+ } else {
+ tmp = (*value & mask) << -shift;
+ }
if (mr->subpage) {
trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);
} else if (mr == &io_mem_notdirty) {
@@ -566,7 +590,7 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
hwaddr addr,
uint64_t *value,
unsigned size,
- unsigned shift,
+ signed shift,
uint64_t mask,
MemTxAttrs attrs),
MemoryRegion *mr,
@@ -574,7 +598,9 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
{
uint64_t access_mask;
unsigned access_size;
- unsigned i;
+ hwaddr access_addr;
+ unsigned offset;
+ signed shift;
MemTxResult r = MEMTX_OK;
if (!access_size_min) {
@@ -586,16 +612,20 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
/* FIXME: support unaligned access? */
access_size = MAX(MIN(size, access_size_max), access_size_min);
- access_mask = -1ULL >> (64 - access_size * 8);
- if (memory_region_big_endian(mr)) {
- for (i = 0; i < size; i += access_size) {
- r |= access_fn(mr, addr + i, value, access_size,
- (size - access_size - i) * 8, access_mask, attrs);
+ access_mask = -1ULL >> (64 - size * 8);
+ access_addr = addr & ~(access_size - 1);
+ if (likely(size >= access_size)) {
+ offset = addr & (access_size - 1);
+ shift = access_size - size - offset;
+ if (!memory_region_big_endian(mr)) {
+ shift = -shift;
}
+ r = access_fn(mr, access_addr, value, access_size,
+ shift * 8, access_mask, attrs);
} else {
- for (i = 0; i < size; i += access_size) {
- r |= access_fn(mr, addr + i, value, access_size, i * 8,
- access_mask, attrs);
+ for (offset = 0; offset < size; offset += access_size) {
+ r |= access_fn(mr, access_addr + offset, value, access_size,
+ offset * 8, access_mask, attrs);
}
}
return r;
--
2.16.3
next prev parent reply other threads:[~2018-04-05 1:23 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-05 1:22 [Qemu-devel] [RFC PATCH v2 0/4] memory: fix access_with_adjusted_size() and misc Philippe Mathieu-Daudé
2018-04-05 1:22 ` [Qemu-devel] [PATCH v2 1/4] memory: Avoid to create tiny RAM regions, handled as subpages Philippe Mathieu-Daudé
2018-04-05 9:27 ` Peter Maydell
2018-04-05 12:53 ` Philippe Mathieu-Daudé
2018-04-05 13:20 ` Peter Maydell
2018-04-05 13:31 ` Philippe Mathieu-Daudé
2018-04-05 13:34 ` KONRAD Frederic
2018-04-05 13:42 ` Peter Maydell
2018-04-05 1:22 ` Philippe Mathieu-Daudé [this message]
2018-04-08 19:21 ` [Qemu-devel] [NOTFORMERGE PATCH v2 2/4] memory: Fix access_with_adjusted_size() when size < access_size_min Philippe Mathieu-Daudé
2018-04-05 1:22 ` [Qemu-devel] [PATCH v2 3/4] memory: Fix memory_region 'priority' property sign Philippe Mathieu-Daudé
2021-03-27 13:57 ` Philippe Mathieu-Daudé
2021-03-27 14:30 ` Philippe Mathieu-Daudé
2018-04-05 1:22 ` [Qemu-devel] [RFC PATCH v2 4/4] memory: Add memory_region_set_priority() Philippe Mathieu-Daudé
2018-04-05 3:25 ` Alexey Kardashevskiy
2018-04-05 8:44 ` KONRAD Frederic
2018-04-06 5:14 ` Alexey Kardashevskiy
2018-04-05 1:30 ` [Qemu-devel] [RFC PATCH v2 0/4] memory: fix access_with_adjusted_size() and misc no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180405012241.25714-3-f4bug@amsat.org \
--to=f4bug@amsat.org \
--cc=aik@ozlabs.ru \
--cc=frederic.konrad@adacore.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).