From: Jan Beulich <jbeulich@suse.com>
To: "xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>
Cc: "Andrew Cooper" <andrew.cooper3@citrix.com>,
"Wei Liu" <wl@xen.org>, "Roger Pau Monné" <roger.pau@citrix.com>
Subject: [PATCH] x86emul: replace UB shifts
Date: Fri, 31 Jul 2020 09:06:35 +0200 [thread overview]
Message-ID: <bd679766-939d-3176-c913-e993dd48ef15@suse.com> (raw)
Displacement values can be negative, hence we shouldn't left-shift them.
While auditing shifts, I noticed a pair of missing parentheses, which
also get added right here.
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3370,7 +3370,7 @@ x86_decode(
{
generate_exception_if(d & vSIB, EXC_UD);
modrm_rm |= ((rex_prefix & 1) << 3) |
- (evex_encoded() && !evex.x) << 4;
+ ((evex_encoded() && !evex.x) << 4);
ea.type = OP_REG;
}
else if ( ad_bytes == 2 )
@@ -3417,7 +3417,7 @@ x86_decode(
ea.mem.off = insn_fetch_type(int16_t);
break;
case 1:
- ea.mem.off += insn_fetch_type(int8_t) << disp8scale;
+ ea.mem.off += insn_fetch_type(int8_t) * (1 << disp8scale);
break;
case 2:
ea.mem.off += insn_fetch_type(int16_t);
@@ -3479,7 +3479,7 @@ x86_decode(
pc_rel = mode_64bit();
break;
case 1:
- ea.mem.off += insn_fetch_type(int8_t) << disp8scale;
+ ea.mem.off += insn_fetch_type(int8_t) * (1 << disp8scale);
break;
case 2:
ea.mem.off += insn_fetch_type(int32_t);
@@ -10028,7 +10028,8 @@ x86_emulate(
continue;
rc = ops->write(ea.mem.seg,
- truncate_ea(ea.mem.off + (idx << state->sib_scale)),
+ truncate_ea(ea.mem.off +
+ idx * (1 << state->sib_scale)),
(void *)mmvalp + i * op_bytes, op_bytes, ctxt);
if ( rc != X86EMUL_OKAY )
{
@@ -10146,7 +10147,7 @@ x86_emulate(
? ops->write
: ops->read)(ea.mem.seg,
truncate_ea(ea.mem.off +
- (idx << state->sib_scale)),
+ idx * (1 << state->sib_scale)),
NULL, 0, ctxt);
if ( rc == X86EMUL_EXCEPTION )
{
next reply other threads:[~2020-07-31 7:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-31 7:06 Jan Beulich [this message]
2020-07-31 10:50 ` [PATCH] x86emul: replace UB shifts Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bd679766-939d-3176-c913-e993dd48ef15@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).