Commit 54c0d7ec0b for qemu.org

commit 54c0d7ec0b4e72617675d0fc027bbd81f23cce3f
Author: Brian Cain <brian.cain@oss.qualcomm.com>
Date:   Tue Sep 15 09:30:34 2026 -0700

    tests/tcg/hexagon: fix undefined integer overflow in v69_hvx.c

    Cast to uint32_t before multiplying uint16_t values to prevent
    signed integer overflow. Without the cast, the uint16_t operands
    are promoted to int, and the product can overflow the int range.
    Found with UBSan.

    Reviewed-by: Sid Manning <sid.manning@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/tests/tcg/hexagon/v69_hvx.c b/tests/tcg/hexagon/v69_hvx.c
index a0d567d142..eff936064a 100644
--- a/tests/tcg/hexagon/v69_hvx.c
+++ b/tests/tcg/hexagon/v69_hvx.c
@@ -292,7 +292,8 @@ static void test_vmpyuhvs(void)
         pout += sizeof(MMVector);

         for (int j = 0; j < MAX_VEC_SIZE_BYTES / 2; j++) {
-            expect[i].uh[j] = (buffer0[i].uh[j] * buffer1[i].uh[j]) >> 16;
+            expect[i].uh[j] =
+                ((uint32_t)buffer0[i].uh[j] * buffer1[i].uh[j]) >> 16;
         }
     }