Invalid packets can exhaust the available instruction slots while decode_set_slot_number() searches for a valid one. We would then try to evaluate a negative shift before returning the packet as invalid.
Detected by clang's UBSan. Link: https://lore.kernel.org/qemu-devel/CAFEAcA8CYaJ=jayc29rsdumd_swqujqz4fnqyw7ocrwithz...@mail.gmail.com/ Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Pierrick Bouvier <[email protected]> Signed-off-by: Brian Cain <[email protected]> --- target/hexagon/decode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target/hexagon/decode.c b/target/hexagon/decode.c index 35d741ce864..0ac87bbee0c 100644 --- a/target/hexagon/decode.c +++ b/target/hexagon/decode.c @@ -601,9 +601,12 @@ decode_set_slot_number(Packet *pkt) for (i = 0, slot = 3; i < pkt->num_insns; i++) { SlotMask valid_slots = get_valid_slots(pkt, i); - while (!(valid_slots & (1 << slot))) { + while (slot >= 0 && !(valid_slots & (1 << slot))) { slot--; } + if (slot < 0) { + return false; + } pkt->insn[i].slot = slot; if (slot) { /* I've assigned the slot, now decrement it for the next insn */ -- 2.34.1
