target/i386/kvm: Fix UBSAN shift error in MTRR mask computation

[PATCH] target/i386/kvm: Fix UBSAN shift error in MTRR mask computation

Cédric Le Goater posted 1 patch 2 days, 19 hours ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260722120437.697986-1-clg@redhat.com

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>

target/i386/kvm/kvm.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

Expand all Fold all

[PATCH] target/i386/kvm: Fix UBSAN shift error in MTRR mask computation

Posted by Cédric Le Goater 2 days, 19 hours ago

On AMD EPYC processors, raw CPUID leaf 0x80000008 reports 52 physical
address bits. When a machine type such as microvm forces
host_phys_bits=true, the CPU ends up with phys_bits=52, causing
MAKE_64BIT_MASK(52, 0) to shift by 64 — which is undefined behavior.

Fix by only computing the mask when phys_bits < 52.

Fixes: fcc35e7ccaed ("target-i386: Fill high bits of mtrr mask")
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 target/i386/kvm/kvm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 4272b6770c7c9e3907a8f4de2c3234378f16482e..6dd314c90748e49b1ff27933b208dc552dd58906 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5064,8 +5064,7 @@ static int kvm_get_msrs(X86CPU *cpu)
      * we're migrating to.
      */
 
-    if (cpu->fill_mtrr_mask) {
-        assert(cpu->phys_bits <= 52);
+    if (cpu->fill_mtrr_mask && cpu->phys_bits < 52) {
         mtrr_top_bits = MAKE_64BIT_MASK(cpu->phys_bits, 52 - cpu->phys_bits);
     } else {
         mtrr_top_bits = 0;
-- 
2.55.0

Re: [PATCH] target/i386/kvm: Fix UBSAN shift error in MTRR mask computation

Posted by Philippe Mathieu-Daudé 2 days, 16 hours ago

On 22/7/26 14:04, CÃ©dric Le Goater wrote:
> On AMD EPYC processors, raw CPUID leaf 0x80000008 reports 52 physical
> address bits. When a machine type such as microvm forces
> host_phys_bits=true, the CPU ends up with phys_bits=52, causing
> MAKE_64BIT_MASK(52, 0) to shift by 64 — which is undefined behavior.
> 
> Fix by only computing the mask when phys_bits < 52.
> 
> Fixes: fcc35e7ccaed ("target-i386: Fill high bits of mtrr mask")
> Signed-off-by: Cédric Le Goater <clg@redhat.com>
> ---
>   target/i386/kvm/kvm.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>