summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEmilio G. Cota <cota@braap.org>2018-04-10 11:12:26 -0400
committerRichard Henderson <richard.henderson@linaro.org>2018-05-09 10:12:21 -0700
commit071bd2b628cedbb640be8ca6c25d1949b2e6fe4a (patch)
treec683decf9d9ab9b29f694b4e37fed38bb7eafbaf
parentbfe7ad5be77a6a8925a7ab1628452c8942222102 (diff)
downloadqemu-071bd2b628cedbb640be8ca6c25d1949b2e6fe4a.tar.gz
target/s390x: avoid integer overflow in next_page PC check
If the PC is in the last page of the address space, next_page_start overflows to 0. Fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: Alexander Graf <agraf@suse.de> Cc: David Hildenbrand <david@redhat.com> Cc: qemu-s390x@nongnu.org Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-rw-r--r--target/s390x/translate.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/target/s390x/translate.c b/target/s390x/translate.c
index 7d39ab350d..44449f11ab 100644
--- a/target/s390x/translate.c
+++ b/target/s390x/translate.c
@@ -6163,7 +6163,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
CPUS390XState *env = cs->env_ptr;
DisasContext dc;
target_ulong pc_start;
- uint64_t next_page_start;
+ uint64_t page_start;
int num_insns, max_insns;
ExitStatus status;
bool do_debug;
@@ -6181,7 +6181,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
dc.ex_value = tb->cs_base;
do_debug = dc.singlestep_enabled = cs->singlestep_enabled;
- next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+ page_start = pc_start & TARGET_PAGE_MASK;
num_insns = 0;
max_insns = tb_cflags(tb) & CF_COUNT_MASK;
@@ -6218,7 +6218,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
/* If we reach a page boundary, are single stepping,
or exhaust instruction count, stop generation. */
if (status == NO_EXIT
- && (dc.pc >= next_page_start
+ && (dc.pc - page_start >= TARGET_PAGE_SIZE
|| tcg_op_buf_full()
|| num_insns >= max_insns
|| singlestep