[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] x86/hvm: Fix UB on defensive default case in handle_pio()
- To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Alejandro Vallejo <alejandro.garciavallejo@xxxxxxx>
- Date: Tue, 13 Oct 2026 18:43:56 +0200
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wZwU6Sjg+jgCW0wNM7COHOGNdp+jY+I3apDmc7RdrcU=; b=fHbflLCx1kSXhC4gWW21uBMK8IxhsSoDGBwfpOgodJKY2gJi/Z142bhuCTS4EH13jWqsSZvPv17b76Ns1ug76A2yhxkHJSpQYLsJ13cZ0kTySoyEkAlu1e+njZcZn+3MGDikoUNjlHWxlENpi7tGVkyCA/oxaW+V2RuQrFPIwdWZbBZ+thFdyWT6Mp6XKrF0VSEKlKaCH9UYd9bGMowrEwsWQI7IycRk0fEal/qR0P1MDb1xVFlIi43FMEBnwruD6uvzdFXGNaaEpfRCRvym3YvN5RpEPVkOPdgmgez8TmMU1J8kt1iuCFuS2rK1ENAspFq2Jk52wcEOI+WBcbPQCw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MrGnZ77sr1KDPlTWPWSMe1LL2p0aHf6paT9wlYNwQsOLbbgSzLOyDOM4EvHlD4vKpYtS2X58rbGgU0cqEPH+cB07FOQFEEqmoGKTHmeURbBmfA9qSOt6MYUOswsJk7aHRFFBMHw4DsNhW4PxKMBMz63HQkKM1Yga3JxO4uOhlVLcG9bGlKCUtMw3o0H/j1UHa7jcbrx+m/3jQDdkj3SSjrOkqBWGo/dy8HtCaMU7Qd7vmGDeXs+N4L+DyMaID4S3X54j4rfKtsVS9g0UrtCAPcfJSvILQA32/QHzo8If9w55NtW90Skz1X2IbAsYnzegupJApeM+cZFw7QqR2N0oKQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: Alejandro Vallejo <alejandro.garciavallejo@xxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Roger Pau Monné <roger@xxxxxxxxxxxxxx>, Teddy Astie <teddy.astie@xxxxxxxxxx>
- Delivery-date: Tue, 13 Oct 2026 16:44:45 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
There's a potential 32bit left-shift (when size is 4) to a 32bit value,
which would trigger UB and tickle UBSAN the wrong way. Shifting right an
all-ones mask fixes the issue.
Fixes: 4609fc8eb04e ("x86/hvm: Improve error information in handle_pio()")
Signed-off-by: Alejandro Vallejo <alejandro.garciavallejo@xxxxxxx>
---
xen/arch/x86/hvm/io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c
index 912e55d416..91cc2e1dcb 100644
--- a/xen/arch/x86/hvm/io.c
+++ b/xen/arch/x86/hvm/io.c
@@ -135,7 +135,7 @@ bool handle_pio(uint16_t port, unsigned int size, int dir)
default:
gprintk(XENLOG_ERR, "Unexpected PIO status %d, port %#x %s 0x%0*x\n",
rc, port, dir == IOREQ_WRITE ? "write" : "read",
- size * 2, data & ((1u << (size * 8)) - 1));
+ size * 2, data & (UINT32_MAX >> (32 - size * 8)));
domain_crash(curr->domain);
return false;
}
base-commit: 6b30eca0e388e5aaa4319c647a777d703d7ee752
--
2.43.0
|
