From: Denis Sergeev Date: Mon, 15 Sep 2025 08:01:18 +0000 (+0300) Subject: target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6c51df580d2a64b4e1ef7bdbffeb3615ffe25d43;p=thirdparty%2Fqemu.git target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask In gen_mcrfs() the FPSCR nibble mask is computed as: `~((0xF << shift) & FP_EX_CLEAR_BITS)` Here, 0xF is of type int, so the left shift is performed in 32-bit signed arithmetic. For bfa=0 we get shift=28, and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit signed int. Static analyzers flag this as a potential integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Denis Sergeev Reviewed-by: Chinmay Rath Signed-off-by: Harsh Prateek Bora Link: https://lore.kernel.org/r/20250915080118.29898-1-zeff@altlinux.org Message-ID: <20250915080118.29898-1-zeff@altlinux.org> --- diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc index 28dda150400..464fb1d90f7 100644 --- a/target/ppc/translate/fp-impl.c.inc +++ b/target/ppc/translate/fp-impl.c.inc @@ -396,7 +396,7 @@ static void gen_mcrfs(DisasContext *ctx) tcg_gen_extu_tl_i64(tnew_fpscr, cpu_fpscr); /* Only the exception bits (including FX) should be cleared if read */ tcg_gen_andi_i64(tnew_fpscr, tnew_fpscr, - ~((0xF << shift) & FP_EX_CLEAR_BITS)); + ~(MAKE_64BIT_MASK(shift, 4) & FP_EX_CLEAR_BITS)); /* FEX and VX need to be updated, so don't set fpscr directly */ tmask = tcg_constant_i32(1 << nibble); gen_helper_store_fpscr(tcg_env, tnew_fpscr, tmask);