motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-03 07:43:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

target/hppa: Fix possible overflow in TLB size calculation

Browse source 
Coverty found that the shift of TARGET_PAGE_SIZE (32-bit type) might
overflow.  Fix it by casting TARGET_PAGE_SIZE to a 64-bit type before
doing the shift (CID 1523902 and CID 1523908).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Message-Id: <ZU6F/H8CZr3q4pP/@p100>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Helge Deller 2023-11-10 20:27:43 +01:00 • committed by Richard Henderson
parent e722e5a112
commit 2a23f0f118
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
target/hppa/mem_helper.c
View file

@ -450,7 +450,7 @@ static void itlbt_pa20(CPUHPPAState *env, target_ulong r1,
int mask_shift; int mask_shift;
mask_shift = 2 * (r1 & 0xf); mask_shift = 2 * (r1 & 0xf);
va_size = TARGET_PAGE_SIZE << mask_shift; va_size = (uint64_t)TARGET_PAGE_SIZE << mask_shift;
va_b &= -va_size; va_b &= -va_size;
va_e = va_b + va_size - 1; va_e = va_b + va_size - 1;
@ -505,7 +505,7 @@ static void ptlb_work(CPUState *cpu, run_on_cpu_data data)
*/ */
end = start & 0xf; end = start & 0xf;
start &= TARGET_PAGE_MASK; start &= TARGET_PAGE_MASK;
end = TARGET_PAGE_SIZE << (2 * end); end = (vaddr)TARGET_PAGE_SIZE << (2 * end);
end = start + end - 1; end = start + end - 1;
hppa_flush_tlb_range(env, start, end); hppa_flush_tlb_range(env, start, end);