diff mbox series

target/hppa: Fix possible overflow in TLB size calculation

Message ID ZU6F/H8CZr3q4pP/@p100 (mailing list archive)
State New, archived
Headers show
Series target/hppa: Fix possible overflow in TLB size calculation | expand

Commit Message

Helge Deller Nov. 10, 2023, 7:35 p.m. UTC 
Coverty found that the shift of TARGET_PAGE_SIZE (32-bit type) might
overflow.  Fix it by casting TARGET_PAGE_SIZE to a 64-bit type before
doing the shift (CID 1523902 and CID 1523908).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>

Comments

Richard Henderson Nov. 10, 2023, 10:48 p.m. UTC | #1 
On 11/10/23 11:35, Helge Deller wrote:
> Coverty found that the shift of TARGET_PAGE_SIZE (32-bit type) might
> overflow.  Fix it by casting TARGET_PAGE_SIZE to a 64-bit type before
> doing the shift (CID 1523902 and CID 1523908).
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Helge Deller <deller@gmx.de>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~
diff mbox series

Patch

diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index f100c26290..30f0415d1b 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -460,7 +460,7 @@  static void itlbt_pa20(CPUHPPAState *env, target_ulong r1,
     int mask_shift;
 
     mask_shift = 2 * (r1 & 0xf);
-    va_size = TARGET_PAGE_SIZE << mask_shift;
+    va_size = ((uint64_t) TARGET_PAGE_SIZE) << mask_shift;
     va_b &= -va_size;
     va_e = va_b + va_size - 1;
 
@@ -522,7 +522,7 @@  static void ptlb_work(CPUState *cpu, run_on_cpu_data data)
      */
     end = start & 0xf;
     start &= TARGET_PAGE_MASK;
-    end = TARGET_PAGE_SIZE << (2 * end);
+    end = ((vaddr) TARGET_PAGE_SIZE) << (2 * end);
     end = start + end - 1;
 
     hppa_flush_tlb_range(env, start, end);