OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

target/s390x: avoid integer overflow in next_page PC check 

If the PC is in the last page of the address space, next_page_start
overflows to 0. Fix it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Cc: Cornelia Huck <cohuck@redhat.com>
Cc: Alexander Graf <agraf@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: qemu-s390x@nongnu.org
Signed-off-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Emilio G. Cota 2018-04-10 11:12:26 -04:00 committed by Richard Henderson
parent bfe7ad5be7
commit 071bd2b628
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
target/s390x/translate.c
View File

@ -6163,7 +6163,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
CPUS390XState *env = cs->env_ptr; CPUS390XState *env = cs->env_ptr;
DisasContext dc; DisasContext dc;
target_ulong pc_start; target_ulong pc_start;
uint64_t next_page_start; uint64_t page_start;
int num_insns, max_insns; int num_insns, max_insns;
ExitStatus status; ExitStatus status;
bool do_debug; bool do_debug;
@ -6181,7 +6181,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
dc.ex_value = tb->cs_base; dc.ex_value = tb->cs_base;
do_debug = dc.singlestep_enabled = cs->singlestep_enabled; do_debug = dc.singlestep_enabled = cs->singlestep_enabled;
next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; page_start = pc_start & TARGET_PAGE_MASK;
num_insns = 0; num_insns = 0;
max_insns = tb_cflags(tb) & CF_COUNT_MASK; max_insns = tb_cflags(tb) & CF_COUNT_MASK;
@ -6218,7 +6218,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
/* If we reach a page boundary, are single stepping, /* If we reach a page boundary, are single stepping,
or exhaust instruction count, stop generation. */ or exhaust instruction count, stop generation. */
if (status == NO_EXIT if (status == NO_EXIT
&& (dc.pc >= next_page_start && (dc.pc - page_start >= TARGET_PAGE_SIZE
|| tcg_op_buf_full() || tcg_op_buf_full()
|| num_insns >= max_insns || num_insns >= max_insns
|| singlestep || singlestep