SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

target/mips: Fix possible MSA int overflow

Browse Source 
Fix possible overflow in 1 << (DF_BITS(df) - 2) when DF_BITS(df)
is 64 by using a 64-bit integer for the shift operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reported-by: Dmitriy Fedin <d.fedin@fobos-nt.ru>
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20250124122707.54264-1-gerben@altlinux.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
Denis Rastyogin 2025-01-24 15:26:32 +03:00 committed by Philippe Mathieu-Daudé
parent ff3779a543
commit 96adf9b404
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
target/mips/tcg/msa_helper.c
View File

@ -5577,7 +5577,7 @@ static inline int64_t msa_mulr_q_df(uint32_t df, int64_t arg1, int64_t arg2)
{ {
int64_t q_min = DF_MIN_INT(df); int64_t q_min = DF_MIN_INT(df);
int64_t q_max = DF_MAX_INT(df); int64_t q_max = DF_MAX_INT(df);
int64_t r_bit = 1 << (DF_BITS(df) - 2); int64_t r_bit = 1LL << (DF_BITS(df) - 2);
if (arg1 == q_min && arg2 == q_min) { if (arg1 == q_min && arg2 == q_min) {
return q_max; return q_max;
@ -5685,7 +5685,7 @@ static inline int64_t msa_maddr_q_df(uint32_t df, int64_t dest, int64_t arg1,
int64_t q_max = DF_MAX_INT(df); int64_t q_max = DF_MAX_INT(df);
int64_t q_min = DF_MIN_INT(df); int64_t q_min = DF_MIN_INT(df);
int64_t r_bit = 1 << (DF_BITS(df) - 2); int64_t r_bit = 1LL << (DF_BITS(df) - 2);
q_prod = arg1 * arg2; q_prod = arg1 * arg2;
q_ret = ((dest << (DF_BITS(df) - 1)) + q_prod + r_bit) >> (DF_BITS(df) - 1); q_ret = ((dest << (DF_BITS(df) - 1)) + q_prod + r_bit) >> (DF_BITS(df) - 1);
@ -5700,7 +5700,7 @@ static inline int64_t msa_msubr_q_df(uint32_t df, int64_t dest, int64_t arg1,
int64_t q_max = DF_MAX_INT(df); int64_t q_max = DF_MAX_INT(df);
int64_t q_min = DF_MIN_INT(df); int64_t q_min = DF_MIN_INT(df);
int64_t r_bit = 1 << (DF_BITS(df) - 2); int64_t r_bit = 1LL << (DF_BITS(df) - 2);
q_prod = arg1 * arg2; q_prod = arg1 * arg2;
q_ret = ((dest << (DF_BITS(df) - 1)) - q_prod + r_bit) >> (DF_BITS(df) - 1); q_ret = ((dest << (DF_BITS(df) - 1)) - q_prod + r_bit) >> (DF_BITS(df) - 1);