[v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.

[PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.

agrecascino123@gmail.com posted 1 patch 3 years, 10 months ago

Diff against v1 v1 v3 v4
Download mbox

Test docker-mingw@fedora passed

Test checkpatch passed

Test asan passed

Test docker-quick@centos7 passed

Test FreeBSD passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20200607211100.22858-1-agrecascino123@gmail.com

Maintainers: Richard Henderson <rth@twiddle.net>

tcg/ppc/tcg-target.inc.c | 34 +++++++++++++++++++++++++++++-----
1 file changed, 29 insertions(+), 5 deletions(-)

Expand all Fold all

[PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.

Posted by agrecascino123@gmail.com 3 years, 10 months ago

From: "Catherine A. Frederick" <chocola@animebitch.es>

Signed-off-by: Catherine A. Frederick <chocola@animebitch.es>
---
Okay, I removed the bad "fix" on sar_i64, and the asserts in the various functions. 
Crossing my fingers here.

 tcg/ppc/tcg-target.inc.c | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index 7da67086c6..5cb1556912 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -2610,21 +2610,33 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 
     case INDEX_op_shl_i32:
         if (const_args[2]) {
-            tcg_out_shli32(s, args[0], args[1], args[2]);
+            /*
+             * Limit shift immediate to prevent illegal instruction
+             * from bitmask corruption
+             */
+            tcg_out_shli32(s, args[0], args[1], args[2] & 31);
         } else {
             tcg_out32(s, SLW | SAB(args[1], args[0], args[2]));
         }
         break;
     case INDEX_op_shr_i32:
         if (const_args[2]) {
-            tcg_out_shri32(s, args[0], args[1], args[2]);
+            /*
+             * Both use RLWINM, which has a 5 bit field for the
+             * shift mask.
+             */
+            tcg_out_shri32(s, args[0], args[1], args[2] & 31);
         } else {
             tcg_out32(s, SRW | SAB(args[1], args[0], args[2]));
         }
         break;
     case INDEX_op_sar_i32:
         if (const_args[2]) {
-            tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2]));
+            /*
+             * SRAWI has a 5 bit sized field for the shift mask
+             * as well.
+             */
+            tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2] & 31));
         } else {
             tcg_out32(s, SRAW | SAB(args[1], args[0], args[2]));
         }
@@ -2696,20 +2708,32 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 
     case INDEX_op_shl_i64:
         if (const_args[2]) {
-            tcg_out_shli64(s, args[0], args[1], args[2]);
+            /*
+             * Limit shift immediate to prevent illegal instruction from
+             * from bitmask corruption
+             */
+            tcg_out_shli64(s, args[0], args[1], args[2] & 63);
         } else {
             tcg_out32(s, SLD | SAB(args[1], args[0], args[2]));
         }
         break;
     case INDEX_op_shr_i64:
         if (const_args[2]) {
-            tcg_out_shri64(s, args[0], args[1], args[2]);
+            /*
+             * Same applies here, as both RLDICL, and RLDICR have a
+             * 6 bit large mask for the shift value
+             */
+            tcg_out_shri64(s, args[0], args[1], args[2] & 63);
         } else {
             tcg_out32(s, SRD | SAB(args[1], args[0], args[2]));
         }
         break;
     case INDEX_op_sar_i64:
         if (const_args[2]) {
+            /*
+             * Already done here, as it's a split field, and
+             * somebody noticed it would have overflowed.
+             */
             int sh = SH(args[2] & 0x1f) | (((args[2] >> 5) & 1) << 1);
             tcg_out32(s, SRADI | RA(args[0]) | RS(args[1]) | sh);
         } else {
-- 
2.26.2

Re: [PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.

Posted by Richard Henderson 3 years, 10 months ago

On 6/7/20 2:10 PM, agrecascino123@gmail.com wrote:
> From: "Catherine A. Frederick" <chocola@animebitch.es>
> 
> Signed-off-by: Catherine A. Frederick <chocola@animebitch.es>
> ---
> Okay, I removed the bad "fix" on sar_i64, and the asserts in the various functions. 
> Crossing my fingers here.
> 
>  tcg/ppc/tcg-target.inc.c | 34 +++++++++++++++++++++++++++++-----
>  1 file changed, 29 insertions(+), 5 deletions(-)

Sorry for losing track of this.  Now queued to tcg-next.


r~