From 2b3f56ab514d46bed652527974b74d1cef76b759 Mon Sep 17 00:00:00 2001 From: Alejandro Vallejo Date: Wed, 14 Oct 2026 09:27:28 +0200 Subject: [PATCH] x86/hvm: Fix UB on defensive default case in handle_pio() There's a potential 32bit left-shift (when size is 4) to a 32bit value, which would trigger UB and tickle UBSAN the wrong way. Shifting right an all-ones mask fixes the issue. Fixes: 4609fc8eb04e ("x86/hvm: Improve error information in handle_pio()") Signed-off-by: Alejandro Vallejo Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c index 912e55d416..91cc2e1dcb 100644 --- a/xen/arch/x86/hvm/io.c +++ b/xen/arch/x86/hvm/io.c @@ -135,7 +135,7 @@ bool handle_pio(uint16_t port, unsigned int size, int dir) default: gprintk(XENLOG_ERR, "Unexpected PIO status %d, port %#x %s 0x%0*x\n", rc, port, dir == IOREQ_WRITE ? "write" : "read", - size * 2, data & ((1u << (size * 8)) - 1)); + size * 2, data & (UINT32_MAX >> (32 - size * 8))); domain_crash(curr->domain); return false; }