diff options
| author | Peter Maydell | 2022-07-29 17:59:32 +0200 |
|---|---|---|
| committer | Jason Wang | 2022-08-09 11:02:18 +0200 |
| commit | 7cf745dd9c25f0740dc1009598b58dd8dd989876 (patch) | |
| tree | 5deb3cbed74bac7d5c31a24390af269476e459ae /hw/net | |
| parent | Merge tag 'pull-la-20220808' of https://gitlab.com/rth7680/qemu into staging (diff) | |
| download | qemu-7cf745dd9c25f0740dc1009598b58dd8dd989876.tar.gz qemu-7cf745dd9c25f0740dc1009598b58dd8dd989876.tar.xz qemu-7cf745dd9c25f0740dc1009598b58dd8dd989876.zip | |
hw/net/rocker: Avoid undefined shifts with more than 31 ports
In rocker_port_phys_link_status() and rocker_port_phys_enable_read()
we construct a 64-bit value with one bit per front-panel port.
However we accidentally do the shift as 32-bit arithmetic, which
means that if there are more than 31 front-panel ports this is
undefined behaviour.
Fix the problem by ensuring we use 64-bit arithmetic for the whole
calculation. (We won't ever shift off the 64-bit value because
ROCKER_FP_PORTS_MAX is 62.)
Resolves: Coverity CID 1487121, 1487160
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/net')
| -rw-r--r-- | hw/net/rocker/rocker.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c index 31f2340fb9..d8f3f16fe8 100644 --- a/hw/net/rocker/rocker.c +++ b/hw/net/rocker/rocker.c @@ -1010,7 +1010,7 @@ static uint64_t rocker_port_phys_link_status(Rocker *r) FpPort *port = r->fp_port[i]; if (fp_port_get_link_up(port)) { - status |= 1 << (i + 1); + status |= 1ULL << (i + 1); } } return status; @@ -1025,7 +1025,7 @@ static uint64_t rocker_port_phys_enable_read(Rocker *r) FpPort *port = r->fp_port[i]; if (fp_port_enabled(port)) { - ret |= 1 << (i + 1); + ret |= 1ULL << (i + 1); } } return ret; |