@samitouri / QOSamiQemu / commits / 4adfb431c0

hw/i386/amd_iommu: Avoid undefined behavior in amdvi_setevent_bits()

The code in amdvi_encode_event() calls amdvi_setevent_bits() with start = 64: amdvi_setevent_bits(evt, addr, 64, 64); and amdvi_setevent_bits() then calculates: uint64_t mask = MAKE_64BIT_MASK(start, length); but this MAKE_64BIT_MASK() macro shifts a value left by "start" bit positions. Shifting left by more than 63 is undefined behavior and could have unexpected results with different compilers / architectures. Fix it by using "bitpos" instead, which was likely the original intended behavior anyway. (bitpos is calculated as bitpos = start % 64). Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3633 Fixes: 1d5b128cbeea ("hw/iommu: Fix problems reported by Coverity scan") Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20260731140229.259272-1-thuth@redhat.com>

Thomas Huth committed Jul 31, 2026 at 16:02 UTC 4adfb431c0c3abd84909d1228b4954bfd68a1dbc

1 file changed +1 -1

hw/i386/amd_iommu.c

+1 -1

@@ -323,7 +323,7 @@ static void amdvi_setevent_bits(uint64_t *buffer, uint64_t value, int start,

323 int length)

324 {

325 int index = start / 64, bitpos = start % 64;

326 - uint64_t mask = MAKE_64BIT_MASK(start, length);

326 + uint64_t mask = MAKE_64BIT_MASK(bitpos, length);

327 buffer[index] &= ~mask;

328 buffer[index] |= (value << bitpos) & mask;

329 }