aboutsummaryrefslogtreecommitdiff
path: root/target
diff options
context:
space:
mode:
authorHelge Deller <deller@gmx.de>2023-11-10 20:27:43 +0100
committerRichard Henderson <richard.henderson@linaro.org>2023-11-13 09:17:07 -0800
commit2a23f0f1189666fe453027eca60daf03c561bfd6 (patch)
tree4a9cefb28d08e137887be01a5c669b3bc4e1054d /target
parente722e5a11212f3080456dea1c3cc5b231d1d3a2d (diff)
downloadqemu-2a23f0f1189666fe453027eca60daf03c561bfd6.zip
qemu-2a23f0f1189666fe453027eca60daf03c561bfd6.tar.gz
qemu-2a23f0f1189666fe453027eca60daf03c561bfd6.tar.bz2
target/hppa: Fix possible overflow in TLB size calculation
Coverty found that the shift of TARGET_PAGE_SIZE (32-bit type) might overflow. Fix it by casting TARGET_PAGE_SIZE to a 64-bit type before doing the shift (CID 1523902 and CID 1523908). Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Helge Deller <deller@gmx.de> Message-Id: <ZU6F/H8CZr3q4pP/@p100> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'target')
-rw-r--r--target/hppa/mem_helper.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index 858ce6e..a13f200 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -450,7 +450,7 @@ static void itlbt_pa20(CPUHPPAState *env, target_ulong r1,
int mask_shift;
mask_shift = 2 * (r1 & 0xf);
- va_size = TARGET_PAGE_SIZE << mask_shift;
+ va_size = (uint64_t)TARGET_PAGE_SIZE << mask_shift;
va_b &= -va_size;
va_e = va_b + va_size - 1;
@@ -505,7 +505,7 @@ static void ptlb_work(CPUState *cpu, run_on_cpu_data data)
*/
end = start & 0xf;
start &= TARGET_PAGE_MASK;
- end = TARGET_PAGE_SIZE << (2 * end);
+ end = (vaddr)TARGET_PAGE_SIZE << (2 * end);
end = start + end - 1;
hppa_flush_tlb_range(env, start, end);