diff mbox

target-ppc: fix left shift overflow in hpte_page_shift

Message ID 1468596130-27783-1-git-send-email-pbonzini@redhat.com
State New
Headers show

Commit Message

Paolo Bonzini July 15, 2016, 3:22 p.m. UTC
ps->pte_enc is a 32-bit value, which is shifted left and then compared
to a 64-bit value.  It needs a cast before the shift.

Reported by Coverity.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-ppc/mmu-hash64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

David Gibson July 18, 2016, 12:45 a.m. UTC | #1
On Fri, Jul 15, 2016 at 05:22:10PM +0200, Paolo Bonzini wrote:
> ps->pte_enc is a 32-bit value, which is shifted left and then compared
> to a 64-bit value.  It needs a cast before the shift.
> 
> Reported by Coverity.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Applied to ppc-for-2.7, thanks.

> ---
>  target-ppc/mmu-hash64.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
> index 82c2186..8f7e5b4 100644
> --- a/target-ppc/mmu-hash64.c
> +++ b/target-ppc/mmu-hash64.c
> @@ -479,7 +479,7 @@ static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
>  
>          mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
>  
> -        if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
> +        if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
>              return ps->page_shift;
>          }
>      }
diff mbox

Patch

diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 82c2186..8f7e5b4 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -479,7 +479,7 @@  static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
 
         mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
 
-        if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
+        if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
             return ps->page_shift;
         }
     }