diff options
| author | Phil Dennis-Jordan <phil@philjordan.eu> | 2024-11-05 16:57:57 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-11-09 08:34:07 +0100 |
| commit | e3150028fffb808452078ead055fc6a4d50a63e9 (patch) | |
| tree | 31973992a06a670529e4ba3f64b3666b4de21709 | |
| parent | 0e27f3a5d0cbc0099ba8dcd7ff78e7f80d0c4f15 (diff) | |
i386/hvf: Fix for UB in handling CPUID function 0xD
The handling for CPUID function 0xD (supported XSAVE features) was
improved in a recent patch. Unfortunately, this appears to have
introduced undefined behaviour for cases where ecx > 30, as the result
of (1 << idx) is undefined if idx > 30.
Per Intel SDM section 13.2, the behaviour for ecx values up to and
including 62 are specified. This change therefore specifically sets
all registers returned by the CPUID instruction to 0 for 63 and higher.
Furthermore, the bit shift uses uint64_t, where behaviour for the entire
range of 2..62 is safe and correct.
Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu>
Link: https://lore.kernel.org/r/20241105155800.5461-3-phil@philjordan.eu
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/hvf/x86_cpuid.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/target/i386/hvf/x86_cpuid.c b/target/i386/hvf/x86_cpuid.c index 3f16b0f363..af9ee17a11 100644 --- a/target/i386/hvf/x86_cpuid.c +++ b/target/i386/hvf/x86_cpuid.c @@ -119,8 +119,8 @@ uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx, eax = 0; break; case 0xD: - if (!supported_xcr0 || - (idx > 1 && !(supported_xcr0 & (1 << idx)))) { + if (!supported_xcr0 || idx >= 63 || + (idx > 1 && !(supported_xcr0 & (UINT64_C(1) << idx)))) { eax = ebx = ecx = edx = 0; break; } |