* [PATCH] ppc/xive: Fix uint32_t overflow
@ 2023-09-13 5:56 Cédric Le Goater
2023-09-13 6:20 ` Philippe Mathieu-Daudé
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Cédric Le Goater @ 2023-09-13 5:56 UTC (permalink / raw)
To: qemu-ppc, qemu-devel
Cc: Frédéric Barrat, Nicholas Piggin, Cédric Le Goater
As reported by Coverity, "idx << xive->pc_shift" is evaluated using
32-bit arithmetic, and then used in a context expecting a "uint64_t".
Add a uint64_t cast.
Fixes: Coverity CID 1519049
Fixes: b68147b7a5bf ("ppc/xive: Add support for the PC MMIOs")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
hw/intc/pnv_xive.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index 9b10e905195a..a36b3bf08c92 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -210,7 +210,7 @@ static uint64_t pnv_xive_vst_addr_remote(PnvXive *xive, uint32_t type,
return 0;
}
- remote_addr |= idx << xive->pc_shift;
+ remote_addr |= ((uint64_t) idx) << xive->pc_shift;
vst_addr = address_space_ldq_be(&address_space_memory, remote_addr,
MEMTXATTRS_UNSPECIFIED, &result);
--
2.41.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] ppc/xive: Fix uint32_t overflow
2023-09-13 5:56 [PATCH] ppc/xive: Fix uint32_t overflow Cédric Le Goater
@ 2023-09-13 6:20 ` Philippe Mathieu-Daudé
2023-09-13 6:30 ` Frederic Barrat
2023-09-14 14:42 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2023-09-13 6:20 UTC (permalink / raw)
To: Cédric Le Goater, qemu-ppc, qemu-devel
Cc: Frédéric Barrat, Nicholas Piggin
On 13/9/23 07:56, Cédric Le Goater wrote:
> As reported by Coverity, "idx << xive->pc_shift" is evaluated using
> 32-bit arithmetic, and then used in a context expecting a "uint64_t".
> Add a uint64_t cast.
>
> Fixes: Coverity CID 1519049
> Fixes: b68147b7a5bf ("ppc/xive: Add support for the PC MMIOs")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
> hw/intc/pnv_xive.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ppc/xive: Fix uint32_t overflow
2023-09-13 5:56 [PATCH] ppc/xive: Fix uint32_t overflow Cédric Le Goater
2023-09-13 6:20 ` Philippe Mathieu-Daudé
@ 2023-09-13 6:30 ` Frederic Barrat
2023-09-14 14:42 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Frederic Barrat @ 2023-09-13 6:30 UTC (permalink / raw)
To: Cédric Le Goater, qemu-ppc, qemu-devel; +Cc: Nicholas Piggin
On 13/09/2023 07:56, Cédric Le Goater wrote:
> As reported by Coverity, "idx << xive->pc_shift" is evaluated using
> 32-bit arithmetic, and then used in a context expecting a "uint64_t".
> Add a uint64_t cast.
>
> Fixes: Coverity CID 1519049
> Fixes: b68147b7a5bf ("ppc/xive: Add support for the PC MMIOs")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
> hw/intc/pnv_xive.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
> index 9b10e905195a..a36b3bf08c92 100644
> --- a/hw/intc/pnv_xive.c
> +++ b/hw/intc/pnv_xive.c
> @@ -210,7 +210,7 @@ static uint64_t pnv_xive_vst_addr_remote(PnvXive *xive, uint32_t type,
> return 0;
> }
>
> - remote_addr |= idx << xive->pc_shift;
> + remote_addr |= ((uint64_t) idx) << xive->pc_shift;
>
> vst_addr = address_space_ldq_be(&address_space_memory, remote_addr,
> MEMTXATTRS_UNSPECIFIED, &result);
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ppc/xive: Fix uint32_t overflow
2023-09-13 5:56 [PATCH] ppc/xive: Fix uint32_t overflow Cédric Le Goater
2023-09-13 6:20 ` Philippe Mathieu-Daudé
2023-09-13 6:30 ` Frederic Barrat
@ 2023-09-14 14:42 ` Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Peter Maydell @ 2023-09-14 14:42 UTC (permalink / raw)
To: Cédric Le Goater
Cc: qemu-ppc, qemu-devel, Frédéric Barrat, Nicholas Piggin
On Wed, 13 Sept 2023 at 06:57, Cédric Le Goater <clg@kaod.org> wrote:
>
> As reported by Coverity, "idx << xive->pc_shift" is evaluated using
> 32-bit arithmetic, and then used in a context expecting a "uint64_t".
> Add a uint64_t cast.
>
> Fixes: Coverity CID 1519049
> Fixes: b68147b7a5bf ("ppc/xive: Add support for the PC MMIOs")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
> hw/intc/pnv_xive.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
> index 9b10e905195a..a36b3bf08c92 100644
> --- a/hw/intc/pnv_xive.c
> +++ b/hw/intc/pnv_xive.c
> @@ -210,7 +210,7 @@ static uint64_t pnv_xive_vst_addr_remote(PnvXive *xive, uint32_t type,
> return 0;
> }
>
> - remote_addr |= idx << xive->pc_shift;
> + remote_addr |= ((uint64_t) idx) << xive->pc_shift;
Nit: our coding style doesn't want a space after the '(uint64_t)'.
thanks
-- PMM
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-14 14:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-13 5:56 [PATCH] ppc/xive: Fix uint32_t overflow Cédric Le Goater
2023-09-13 6:20 ` Philippe Mathieu-Daudé
2023-09-13 6:30 ` Frederic Barrat
2023-09-14 14:42 ` Peter Maydell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).