Commit 4adfb431c0 for qemu.org

commit 4adfb431c0c3abd84909d1228b4954bfd68a1dbc
Author: Thomas Huth <thuth@redhat.com>
Date:   Fri Jul 31 16:02:29 2026 +0200

    hw/i386/amd_iommu: Avoid undefined behavior in amdvi_setevent_bits()

    The code in amdvi_encode_event() calls amdvi_setevent_bits() with
    start = 64:

        amdvi_setevent_bits(evt, addr, 64, 64);

    and amdvi_setevent_bits() then calculates:

        uint64_t mask = MAKE_64BIT_MASK(start, length);

    but this MAKE_64BIT_MASK() macro shifts a value left by "start" bit
    positions. Shifting left by more than 63 is undefined behavior and
    could have unexpected results with different compilers / architectures.

    Fix it by using "bitpos" instead, which was likely the original
    intended behavior anyway. (bitpos is calculated as bitpos = start % 64).

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3633
    Fixes: 1d5b128cbeea ("hw/iommu: Fix problems reported by Coverity scan")
    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Message-ID: <20260731140229.259272-1-thuth@redhat.com>

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 90252c52af..578c27ccbe 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -323,7 +323,7 @@ static void amdvi_setevent_bits(uint64_t *buffer, uint64_t value, int start,
                                 int length)
 {
     int index = start / 64, bitpos = start % 64;
-    uint64_t mask = MAKE_64BIT_MASK(start, length);
+    uint64_t mask = MAKE_64BIT_MASK(bitpos, length);
     buffer[index] &= ~mask;
     buffer[index] |= (value << bitpos) & mask;
 }