Invalid packets can exhaust the available instruction slots while decode_set_slot_number() searches for a valid one. We would then try to evaluate a negative shift before returning the packet as invalid.
Detected by clang's UBSan. Link: https://lore.kernel.org/qemu-devel/CAFEAcA8CYaJ=jayc29rsdumd_swqujqz4fnqyw7ocrwithz...@mail.gmail.com/ Signed-off-by: Brian Cain <[email protected]> --- target/hexagon/decode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target/hexagon/decode.c b/target/hexagon/decode.c index 89e961331ff..8391b51d629 100644 --- a/target/hexagon/decode.c +++ b/target/hexagon/decode.c @@ -600,9 +600,12 @@ decode_set_slot_number(Packet *pkt) for (i = 0, slot = 3; i < pkt->num_insns; i++) { SlotMask valid_slots = get_valid_slots(pkt, i); - while (!(valid_slots & (1 << slot))) { + while (slot >= 0 && !(valid_slots & (1 << slot))) { slot--; } + if (slot < 0) { + return false; + } pkt->insn[i].slot = slot; if (slot) { /* I've assigned the slot, now decrement it for the next insn */ -- 2.34.1
