target/ppc: fix potential shift overflow by using 64-bit constant

[PATCH] target/ppc: fix potential shift overflow by using 64-bit constant

Posted by gerben@altlinux.org 3 months, 3 weeks ago

From: Denis Rastyogin <gerben@altlinux.org>

Change shift operand from 32-bit literal `1` to 64-bit `1ULL` to avoid undefined behavior
when shifting bits beyond the width of a 32-bit integer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
 target/ppc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 27f90c3cc5..8e69c4cb48 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -2998,7 +2998,7 @@ static void gen_fetch_inc_conditional(DisasContext *ctx, MemOp memop,
 
     /* RT = (t != t2 ? t : u = 1<<(s*8-1)) */
     tcg_gen_movcond_tl(cond, cpu_gpr[rD(ctx->opcode)], t, t2, t,
-                       tcg_constant_tl(1 << (memop_size(memop) * 8 - 1)));
+                       tcg_constant_tl(1ULL << (memop_size(memop) * 8 - 1)));
 }
 
 static void gen_ld_atomic(DisasContext *ctx, MemOp memop)
-- 
2.42.2

Re: [PATCH] target/ppc: fix potential shift overflow by using 64-bit constant

Posted by Anushree Mathur 1 month, 3 weeks ago


On 22/07/25 3:46 PM, Denis Rastyogin wrote:
> Change shift operand from 32-bit literal `1` to 64-bit `1ULL` to avoid undefined behavior
> when shifting bits beyond the width of a 32-bit integer.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
> ---
>   target/ppc/translate.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/target/ppc/translate.c b/target/ppc/translate.c
> index 27f90c3cc5..8e69c4cb48 100644
> --- a/target/ppc/translate.c
> +++ b/target/ppc/translate.c
> @@ -2998,7 +2998,7 @@ static void gen_fetch_inc_conditional(DisasContext *ctx, MemOp memop,
>   
>       /* RT = (t != t2 ? t : u = 1<<(s*8-1)) */
>       tcg_gen_movcond_tl(cond, cpu_gpr[rD(ctx->opcode)], t, t2, t,
> -                       tcg_constant_tl(1 << (memop_size(memop) * 8 - 1)));
> +                       tcg_constant_tl(1ULL << (memop_size(memop) * 8 - 1)));
>   }
>   
>   static void gen_ld_atomic(DisasContext *ctx, MemOp memop)
Hi Denis,
  I have tested this by applying the patch and bringing up the guest
in tcg mode and it worked perfectly fine.

Qemu commandline used:

./qemu-system-ppc64 -name test -smp 8 -m 10G -vga none -nographic -accel 
tcg,thread=multi -device virtio-scsi-pci -drive 
file=/home/anu_new.qcow2,if=none,format=qcow2,id=hd0 -device 
scsi-hd,drive=hd0 -boot c

Came to the login prompt:

localhost login:

Tried running basic commands too on the guest, everything worked fine.

Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com>

Thanks,
Anushree Mathur