| Message ID | 20230703155801.179167-8-iii@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | target/s390x: Miscellaneous TCG fixes | expand |
On 03.07.23 17:50, Ilya Leoshkevich wrote: > The expression "imm * 2" in gen_ri2() can wrap around if imm is large > enough. > > Fix by casting imm to int64_t, like it's done in disas_jdest(). > > Fixes: e8ecdfeb30f0 ("Fix EXECUTE of relative branches") > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> > --- > target/s390x/tcg/translate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c > index a6079ab7b4f..6661b27efa4 100644 > --- a/target/s390x/tcg/translate.c > +++ b/target/s390x/tcg/translate.c > @@ -5794,7 +5794,7 @@ static TCGv gen_ri2(DisasContext *s) > > disas_jdest(s, i2, is_imm, imm, ri2); > if (is_imm) { > - ri2 = tcg_constant_i64(s->base.pc_next + imm * 2); > + ri2 = tcg_constant_i64(s->base.pc_next + (int64_t)imm * 2); > } > > return ri2; Reviewed-by: David Hildenbrand <david@redhat.com>
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c index a6079ab7b4f..6661b27efa4 100644 --- a/target/s390x/tcg/translate.c +++ b/target/s390x/tcg/translate.c @@ -5794,7 +5794,7 @@ static TCGv gen_ri2(DisasContext *s) disas_jdest(s, i2, is_imm, imm, ri2); if (is_imm) { - ri2 = tcg_constant_i64(s->base.pc_next + imm * 2); + ri2 = tcg_constant_i64(s->base.pc_next + (int64_t)imm * 2); } return ri2;
The expression "imm * 2" in gen_ri2() can wrap around if imm is large enough. Fix by casting imm to int64_t, like it's done in disas_jdest(). Fixes: e8ecdfeb30f0 ("Fix EXECUTE of relative branches") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> --- target/s390x/tcg/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)