From nobody Sun Feb 8 23:50:55 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1745839767; cv=none; d=zohomail.com; s=zohoarc; b=AyHzSvw8zevUXh1BfXlVmQK/n/uWJ0BIv93nqboEyutz2bmIvQ8LbB0wIJheJcMQEk8faIPX7/3qhW4JuPehxn2dn0jDUp/fVnesaMEICDUOz5CRGr0Ehj2Er76UVaZy/R5PCmRjz6B5l/7ykRIFp63VUt8IoA85v2Uck/essDI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1745839767; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mN3gNNgsaWkJoaA7AforPMWrjwvk0E5HAamOs0gAg/Y=; b=JTAz5NfClHFXrD7HKViIVkpRQFLsqdUiOsKRuJ/T0xif4lUmVQ6NrSNDyefXVJ4rqkbq5aEeaXR+bwQFWvsyLugNt3rFkOBpeJ2MGXF/9J7/8oG2gv2JV/3/icWD3DVRWKRluHBkPN2/8v0vOaD4bzOXQsnrivMM99qXIEXCZ5M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1745839767234217.4730133636201; Mon, 28 Apr 2025 04:29:27 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.970567.1359220 (Exim 4.92) (envelope-from ) id 1u9Mfh-0004rA-UT; Mon, 28 Apr 2025 11:29:13 +0000 Received: by outflank-mailman (output) from mailman id 970567.1359220; Mon, 28 Apr 2025 11:29:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1u9Mfh-0004r3-Rg; Mon, 28 Apr 2025 11:29:13 +0000 Received: by outflank-mailman (input) for mailman id 970567; Mon, 28 Apr 2025 11:29:11 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1u9Mff-0004qq-Qd for xen-devel@lists.xenproject.org; Mon, 28 Apr 2025 11:29:11 +0000 Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [2a00:1450:4864:20::431]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 007d2ee7-2424-11f0-9ffb-bf95429c2676; Mon, 28 Apr 2025 13:29:09 +0200 (CEST) Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-39c1efc457bso3283278f8f.2 for ; Mon, 28 Apr 2025 04:29:09 -0700 (PDT) Received: from [10.156.60.236] (ip-037-024-206-209.um08.pools.vodafone-ip.de. [37.24.206.209]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3a073e5c68esm10768925f8f.82.2025.04.28.04.29.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 28 Apr 2025 04:29:08 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 007d2ee7-2424-11f0-9ffb-bf95429c2676 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1745839749; x=1746444549; darn=lists.xenproject.org; h=content-transfer-encoding:autocrypt:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to; bh=mN3gNNgsaWkJoaA7AforPMWrjwvk0E5HAamOs0gAg/Y=; b=OIqtEo9SLBsF1XNs6WkjA3DKDnZlVUSH3QXwTYD9n12Yi4TgP35QiLxCKB7OEyS07n b7D7R65ulOM8hmb2fDDftvw1tWWvXaueXzl2p6NlBNUcP3J/BcEkSK3fc2YT6OJ3OLih VXILvVojefQ7u0fzn5s1loNbevZnGjpfQbmqshvoqtcpp0RFk5eUI9T1vm90MVySznS+ omp7qygygDEW6FWyOTomTvWM0U2aHo2c0v6RhH1IXbGyEJ6B0Lyw6jQ05E54aa7YCX5d Gm2wOD08rOTUAIQ1Ld51T9LldW/0jBJGbyhHxsfEr85Ux2cfkITHq+TUbBfI5o4oMqJY hTfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745839749; x=1746444549; h=content-transfer-encoding:autocrypt:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=mN3gNNgsaWkJoaA7AforPMWrjwvk0E5HAamOs0gAg/Y=; b=r3D/JUns1NANpSqSJCGf0qDH1mw4JvGBrFQAm49ey0sEeHf616DcdiKobkScEw5w/e l+K+B1U7VBqZRhIT8awYIqbBF4HAvt6zxw3Oyf5h2RHyarRfkvvt+gbPbjNg5s6fSEby QkbAueeL10WaZi/qvrwd1PlaF90oJZ3ykjpf0nT3pp7BXp6OKHedI2x1Ohitl0aiwBub cJy13V4I4jePZoSkXN/p88sXSvKLvDX4wcSEKTXHbFQ5QF8KKN7jXZQMRPNeUUFYwrMR go0P+CQOXe9GWyuBULsF5QN+8Hu8dOgQbFKVc1sg1MiPw94/lI5tJKAoy+dQGK364FhM /AAQ== X-Gm-Message-State: AOJu0YwCPv9DboKu/SwCpyDzm4H/JhbZNQCGP7guge/799WlhdQcOTjv dmpouFKLFSmeW+68XQiN6FRaorpRzok70dZz3VU0OFOtPHVBBiNBFlBcf0YPL2Ri96gKqh5M4ao = X-Gm-Gg: ASbGnctaDk7ckNKTPm4M2jV4oXO7rJilpppYnx7gJxRdUUjqk2SHDR3N/zFu1vMA734 g4MrxA3VfkSJ2aygMnxmbH/6Kv9ZRirSGa3lygGjdERrGl1a2tAxN/hl1Jgb2c2ix8l5QnUKkWk oeETz5L2+iOCbjKqREnvyYcGnL1zTmsTAFSU9ejlz2CliBuOSZkehq4ThsrdS5/QNV8VyQm3EoO 1Dljfl4o0JZsbPe4BZdxAb4eSA1tEPlRGHszkJaPLvJD0Q/RN/n4MDIOOHh0d5LOKj3aiW4T1up QYEJ91O3fAMZz5j3mw3Roe7unsHC24NVy5ZP1g1FEHf5Vmllca7QYlaViapH3UZenVpMPT5I2as +c5MGIU9IMoMGUoUs9DICyLOyIg== X-Google-Smtp-Source: AGHT+IGF9RPUny99dJc5Lj9TPw36yCnwMnSIlvrPZkwN8T53DmLQZTIK3maTImuhR/FaAqPwSZKGkg== X-Received: by 2002:a05:6000:1a8e:b0:391:3b11:d604 with SMTP id ffacd0b85a97d-3a07adb1d30mr6994175f8f.54.1745839749085; Mon, 28 Apr 2025 04:29:09 -0700 (PDT) Message-ID: Date: Mon, 28 Apr 2025 13:29:08 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: "xen-devel@lists.xenproject.org" Cc: Andrew Cooper , =?UTF-8?Q?Roger_Pau_Monn=C3=A9?= , Fabian Specht From: Jan Beulich Subject: [PATCH] x86emul: avoid UB shifts in FLDENV/FRSTOR handling Autocrypt: addr=jbeulich@suse.com; keydata= xsDiBFk3nEQRBADAEaSw6zC/EJkiwGPXbWtPxl2xCdSoeepS07jW8UgcHNurfHvUzogEq5xk hu507c3BarVjyWCJOylMNR98Yd8VqD9UfmX0Hb8/BrA+Hl6/DB/eqGptrf4BSRwcZQM32aZK 7Pj2XbGWIUrZrd70x1eAP9QE3P79Y2oLrsCgbZJfEwCgvz9JjGmQqQkRiTVzlZVCJYcyGGsD /0tbFCzD2h20ahe8rC1gbb3K3qk+LpBtvjBu1RY9drYk0NymiGbJWZgab6t1jM7sk2vuf0Py O9Hf9XBmK0uE9IgMaiCpc32XV9oASz6UJebwkX+zF2jG5I1BfnO9g7KlotcA/v5ClMjgo6Gl MDY4HxoSRu3i1cqqSDtVlt+AOVBJBACrZcnHAUSuCXBPy0jOlBhxPqRWv6ND4c9PH1xjQ3NP nxJuMBS8rnNg22uyfAgmBKNLpLgAGVRMZGaGoJObGf72s6TeIqKJo/LtggAS9qAUiuKVnygo 3wjfkS9A3DRO+SpU7JqWdsveeIQyeyEJ/8PTowmSQLakF+3fote9ybzd880fSmFuIEJldWxp Y2ggPGpiZXVsaWNoQHN1c2UuY29tPsJgBBMRAgAgBQJZN5xEAhsDBgsJCAcDAgQVAggDBBYC AwECHgECF4AACgkQoDSui/t3IH4J+wCfQ5jHdEjCRHj23O/5ttg9r9OIruwAn3103WUITZee e7Sbg12UgcQ5lv7SzsFNBFk3nEQQCACCuTjCjFOUdi5Nm244F+78kLghRcin/awv+IrTcIWF hUpSs1Y91iQQ7KItirz5uwCPlwejSJDQJLIS+QtJHaXDXeV6NI0Uef1hP20+y8qydDiVkv6l IreXjTb7DvksRgJNvCkWtYnlS3mYvQ9NzS9PhyALWbXnH6sIJd2O9lKS1Mrfq+y0IXCP10eS FFGg+Av3IQeFatkJAyju0PPthyTqxSI4lZYuJVPknzgaeuJv/2NccrPvmeDg6Coe7ZIeQ8Yj t0ARxu2xytAkkLCel1Lz1WLmwLstV30g80nkgZf/wr+/BXJW/oIvRlonUkxv+IbBM3dX2OV8 AmRv1ySWPTP7AAMFB/9PQK/VtlNUJvg8GXj9ootzrteGfVZVVT4XBJkfwBcpC/XcPzldjv+3 HYudvpdNK3lLujXeA5fLOH+Z/G9WBc5pFVSMocI71I8bT8lIAzreg0WvkWg5V2WZsUMlnDL9 mpwIGFhlbM3gfDMs7MPMu8YQRFVdUvtSpaAs8OFfGQ0ia3LGZcjA6Ik2+xcqscEJzNH+qh8V m5jjp28yZgaqTaRbg3M/+MTbMpicpZuqF4rnB0AQD12/3BNWDR6bmh+EkYSMcEIpQmBM51qM EKYTQGybRCjpnKHGOxG0rfFY1085mBDZCH5Kx0cl0HVJuQKC+dV2ZY5AqjcKwAxpE75MLFkr wkkEGBECAAkFAlk3nEQCGwwACgkQoDSui/t3IH7nnwCfcJWUDUFKdCsBH/E5d+0ZnMQi+G0A nAuWpQkjM1ASeQwSHEeAWPgskBQL Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @suse.com) X-ZM-MESSAGEID: 1745839767923019000 Content-Type: text/plain; charset="utf-8" 16-bit quantities, no matter whether expressed as uint16_t or as bitfield, will be promoted to plain int before doing any arithmetic on them. Shifting such values by 16 will therefore shift into the sign bit, which is UB if that bit becomes set. To account for all reads and all writes accessing opposite members of the same union, introduce yet more local variables to reduce the shift counts to 12. Fixes: be55ed744ed8 ("x86emul: support FLDENV and FRSTOR") Reported-by: Fabian Specht Signed-off-by: Jan Beulich Reviewed-by: Jason Andryuk --- a/xen/arch/x86/x86_emulate/blk.c +++ b/xen/arch/x86/x86_emulate/blk.c @@ -81,17 +81,19 @@ int x86_emul_blk( if ( !s->rex_prefix ) { /* Convert 32-bit real/vm86 to 32-bit prot format. */ - unsigned int fip =3D fpstate.env.mode.real.fip_lo + - (fpstate.env.mode.real.fip_hi << 16); - unsigned int fdp =3D fpstate.env.mode.real.fdp_lo + - (fpstate.env.mode.real.fdp_hi << 16); + unsigned int fip =3D fpstate.env.mode.real.fip_lo & 0xf; + unsigned int fcs =3D (fpstate.env.mode.real.fip_lo >> 4) | + (fpstate.env.mode.real.fip_hi << 12); + unsigned int fdp =3D fpstate.env.mode.real.fdp_lo & 0xf; + unsigned int fds =3D (fpstate.env.mode.real.fdp_lo >> 4) | + (fpstate.env.mode.real.fdp_hi << 12); unsigned int fop =3D fpstate.env.mode.real.fop; =20 - fpstate.env.mode.prot.fip =3D fip & 0xf; - fpstate.env.mode.prot.fcs =3D fip >> 4; + fpstate.env.mode.prot.fip =3D fip; + fpstate.env.mode.prot.fcs =3D fcs; fpstate.env.mode.prot.fop =3D fop; - fpstate.env.mode.prot.fdp =3D fdp & 0xf; - fpstate.env.mode.prot.fds =3D fdp >> 4; + fpstate.env.mode.prot.fdp =3D fdp; + fpstate.env.mode.prot.fds =3D fds; } =20 if ( bytes =3D=3D sizeof(fpstate.env) ) @@ -121,17 +123,19 @@ int x86_emul_blk( else { /* Convert 16-bit real/vm86 to 32-bit prot format. */ - unsigned int fip =3D env->mode.real.fip_lo + - (env->mode.real.fip_hi << 16); - unsigned int fdp =3D env->mode.real.fdp_lo + - (env->mode.real.fdp_hi << 16); + unsigned int fip =3D env->mode.real.fip_lo & 0xf; + unsigned int fcs =3D (env->mode.real.fip_lo >> 4) | + (env->mode.real.fip_hi << 12); + unsigned int fdp =3D env->mode.real.fdp_lo & 0xf; + unsigned int fds =3D (env->mode.real.fdp_lo >> 4) | + (env->mode.real.fdp_hi << 12); unsigned int fop =3D env->mode.real.fop; =20 - fpstate.env.mode.prot.fip =3D fip & 0xf; - fpstate.env.mode.prot.fcs =3D fip >> 4; + fpstate.env.mode.prot.fip =3D fip; + fpstate.env.mode.prot.fcs =3D fcs; fpstate.env.mode.prot.fop =3D fop; - fpstate.env.mode.prot.fdp =3D fdp & 0xf; - fpstate.env.mode.prot.fds =3D fdp >> 4; + fpstate.env.mode.prot.fdp =3D fdp; + fpstate.env.mode.prot.fds =3D fds; } =20 if ( bytes =3D=3D sizeof(*env) )