[Qemu-commits] [qemu/qemu] 20b427: target/mips/mxu_translate.c: Fix array overrun for...

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 20b42789aa4d2a4d292b1fc8590065f9d391d78d
      
https://github.com/qemu/qemu/commit/20b42789aa4d2a4d292b1fc8590065f9d391d78d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-03-22 (Mon, 22 Mar 2021)

  Changed paths:
    M target/mips/mxu_translate.c

  Log Message:
  -----------
  target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

Coverity reported (CID 1450831) an array overrun in
gen_mxu_D16MAX_D16MIN():

  1103     } else if (unlikely((XRb == 0) || (XRa == 0))) {
  ....
  1112         if (opc == OPC_MXU_D16MAX) {
  1113             tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
  1114         } else {
  1115             tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
  1116         }

>>> Overrunning array "mxu_gpr" of 15 8-byte elements at element
    index 4294967295 (byte offset 34359738367) using index "XRa - 1U"
    (which evaluates to 4294967295).

This happens because the code is confused about which of XRa, XRb and
XRc is the output, and which are the inputs.  XRa is the output, but
most of the conditions separating out different special cases are
written as if XRc is the output, with the result that we can end up
in the code path that assumes XRa is non-0 even when it is zero.

Fix the erroneous code, bringing it in to line with the structure
used in functions like gen_mxu_S32MAX_S32MIN() and
gen_mxu_Q8MAX_Q8MIN().

Fixes: CID 1450831
Fixes: bb84cbf38505bd1d8
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210316131353.4533-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: f071dc1f0ccc45e4ac4f538b7c273a0fdcfe1401
      
https://github.com/qemu/qemu/commit/f071dc1f0ccc45e4ac4f538b7c273a0fdcfe1401
  Author: Jiaxun Yang <jiaxun.yang@flygoat.com>
  Date:   2021-03-22 (Mon, 22 Mar 2021)

  Changed paths:
    M docs/system/deprecated.rst

  Log Message:
  -----------
  target/mips: Deprecate Trap-and-Emul KVM support

Upstream kernel had removed both host[1] and guest[2] support.

[1]: 
https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=45c7e8af4a5e3f0bea4ac209eea34118dd57ac64
[2]: 
https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=a1515ec7204edca770c07929df8538fcdb03ad46

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210317011235.7425-1-jiaxun.yang@flygoat.com>
[PMD: Specify mentioned kernel is Linux]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: c95bd5ff1660883d15ad6e0005e4c8571604f51a
      
https://github.com/qemu/qemu/commit/c95bd5ff1660883d15ad6e0005e4c8571604f51a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-03-22 (Mon, 22 Mar 2021)

  Changed paths:
    M docs/system/deprecated.rst
    M target/mips/mxu_translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into 
staging

MIPS patches queue

- Fix array overrun (Coverity CID 1450831)
- Deprecate KVM TE (Trap-and-Emul)

# gpg: Signature made Mon 22 Mar 2021 14:06:48 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" 
[full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd/tags/mips-fixes-20210322:
  target/mips: Deprecate Trap-and-Emul KVM support
  target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/b18475092681...c95bd5ff1660