motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-06 09:13:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

pnv/xive: Fix possible undefined shift error in group size calculation

Browse source 
Coverity discovered a potential shift overflow in group size calculation
in the case of a guest error. Add checks and logs to ensure a issues are
caught.

Make the group and crowd error checking code more similar to one another
while here.

Resolves: Coverity CID 1593724
Fixes: 9cb7f6ebed ("ppc/xive2: Support group-matching when looking for target")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
This commit is contained in:
Nicholas Piggin 2025-03-17 13:18:29 +10:00
parent 033a5649b4
commit 344921309d
2 changed files with 38 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
hw/intc/xive2.c
View file

@ -1153,13 +1153,15 @@ static bool xive2_vp_match_mask(uint32_t cam1, uint32_t cam2,
static uint8_t xive2_get_vp_block_mask(uint32_t nvt_blk, bool crowd)
{
uint8_t size, block_mask = 0b1111;
uint8_t block_mask = 0b1111;
/* 3 supported crowd sizes: 2, 4, 16 */
if (crowd) {
size = xive_get_vpgroup_size(nvt_blk);
if (size == 8) {
qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid crowd size of 8n");
uint32_t size = xive_get_vpgroup_size(nvt_blk);
if (size != 2 && size != 4 && size != 16) {
qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid crowd size of %d",
size);
return block_mask;
}
block_mask &= ~(size - 1);
@ -1172,7 +1174,14 @@ static uint32_t xive2_get_vp_index_mask(uint32_t nvt_index, bool cam_ignore)
uint32_t index_mask = 0xFFFFFF; /* 24 bits */
if (cam_ignore) {
index_mask &= ~(xive_get_vpgroup_size(nvt_index) - 1);
uint32_t size = xive_get_vpgroup_size(nvt_index);
if (size < 2) {
qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid group size of %d",
size);
return index_mask;
}
index_mask &= ~(size - 1);
}
return index_mask;
}