• Paul Mackerras's avatar
    KVM: PPC: Book3S HV: Avoid shifts by negative amounts · cda2eaa3
    Paul Mackerras authored
    The kvmppc_hpte_page_shifts function decodes the actual and base page
    sizes for a HPTE, returning -1 if it doesn't recognize the page size
    encoding.  This then gets used as a shift amount in various places,
    which is undefined behaviour.  This was reported by Coverity.
    
    In fact this should never occur, since we should only get HPTEs in the
    HPT which have a recognized page size encoding.  The only place where
    this might not be true is in the call to kvmppc_actual_pgsz() near the
    beginning of kvmppc_do_h_enter(), where we are validating the HPTE
    value passed in from the guest.
    
    So to fix this and eliminate the undefined behaviour, we make
    kvmppc_hpte_page_shifts return 0 for unrecognized page size encodings,
    and make kvmppc_actual_pgsz() detect that case and return 0 for the
    page size, which will then cause kvmppc_do_h_enter() to return an
    error and refuse to insert any HPTE with an unrecognized page size
    encoding.
    
    To ensure that we don't get undefined behaviour in compute_tlbie_rb(),
    we take the 4k page size path for any unrecognized page size encoding.
    This should never be hit in practice because it is only used on HPTE
    values which have previously been checked for having a recognized
    page size encoding.
    Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
    cda2eaa3
kvm_book3s_64.h 11.4 KB