| Message ID | 20240723172431.1757296-1-peter.maydell@linaro.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | target/sh4: Avoid shift into sign bit in update_itlb_use() | expand |
On 23/7/24 19:24, Peter Maydell wrote: > In update_itlb_use() the variables or_mask and and_mask are uint8_t, > which means that in expressions like "and_mask << 24" the usual C > arithmetic conversions will result in the shift being done as a > signed int type, and so we will shift into the sign bit. For QEMU > this isn't undefined behaviour because we use -fwrapv; but we can > avoid it anyway by using uint32_t types for or_mask and and_mask. > > Resolves: Coverity CID 1547628 > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > target/sh4/helper.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
On 7/24/24 03:24, Peter Maydell wrote: > In update_itlb_use() the variables or_mask and and_mask are uint8_t, > which means that in expressions like "and_mask << 24" the usual C > arithmetic conversions will result in the shift being done as a > signed int type, and so we will shift into the sign bit. For QEMU > this isn't undefined behaviour because we use -fwrapv; but we can > avoid it anyway by using uint32_t types for or_mask and and_mask. > > Resolves: Coverity CID 1547628 > Signed-off-by: Peter Maydell<peter.maydell@linaro.org> > --- > target/sh4/helper.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
On Wed, 24 Jul 2024 02:24:31 +0900, Peter Maydell wrote: > > In update_itlb_use() the variables or_mask and and_mask are uint8_t, > which means that in expressions like "and_mask << 24" the usual C > arithmetic conversions will result in the shift being done as a > signed int type, and so we will shift into the sign bit. For QEMU > this isn't undefined behaviour because we use -fwrapv; but we can > avoid it anyway by using uint32_t types for or_mask and and_mask. > > Resolves: Coverity CID 1547628 > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > target/sh4/helper.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/target/sh4/helper.c b/target/sh4/helper.c > index 67029106277..9659c695504 100644 > --- a/target/sh4/helper.c > +++ b/target/sh4/helper.c > @@ -187,7 +187,7 @@ void superh_cpu_do_interrupt(CPUState *cs) > > static void update_itlb_use(CPUSH4State * env, int itlbnb) > { > - uint8_t or_mask = 0, and_mask = (uint8_t) - 1; > + uint32_t or_mask = 0, and_mask = 0xff; > > switch (itlbnb) { > case 0: > -- > 2.34.1 > Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
On Tue, 23 Jul 2024 at 18:24, Peter Maydell <peter.maydell@linaro.org> wrote: > > In update_itlb_use() the variables or_mask and and_mask are uint8_t, > which means that in expressions like "and_mask << 24" the usual C > arithmetic conversions will result in the shift being done as a > signed int type, and so we will shift into the sign bit. For QEMU > this isn't undefined behaviour because we use -fwrapv; but we can > avoid it anyway by using uint32_t types for or_mask and and_mask. > > Resolves: Coverity CID 1547628 > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> I'll take this via my target-arm queue since I'm doing a pullreq anyway. thanks -- PMM
diff --git a/target/sh4/helper.c b/target/sh4/helper.c index 67029106277..9659c695504 100644 --- a/target/sh4/helper.c +++ b/target/sh4/helper.c @@ -187,7 +187,7 @@ void superh_cpu_do_interrupt(CPUState *cs) static void update_itlb_use(CPUSH4State * env, int itlbnb) { - uint8_t or_mask = 0, and_mask = (uint8_t) - 1; + uint32_t or_mask = 0, and_mask = 0xff; switch (itlbnb) { case 0:
In update_itlb_use() the variables or_mask and and_mask are uint8_t, which means that in expressions like "and_mask << 24" the usual C arithmetic conversions will result in the shift being done as a signed int type, and so we will shift into the sign bit. For QEMU this isn't undefined behaviour because we use -fwrapv; but we can avoid it anyway by using uint32_t types for or_mask and and_mask. Resolves: Coverity CID 1547628 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/sh4/helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)