From ce0b7a15bc1f44f1d788f0a6aaa36244fa95a662 Mon Sep 17 00:00:00 2001 From: Magnus Kulke Date: Wed, 1 Jul 2026 15:03:35 +0200 Subject: [PATCH] accel/mshv: Fix pointer to proc feature bitfield MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Processor features are stored in a union containing two "banks": union hv_partition_processor_features { uint64_t as_uint[2]; struct { uint64_t sse3_support:1; ... } } get_proc_features() to retrieve the 2nd bank was passing a pointer that steps over the whole union (+16B) instead of picking the 2nd bank _in_ the union. This manifests in mismatching feature bits for the 2nd bank and possibly other side-effects caused by writing beyond the union. We need to step over the first bank (+8B) by using as_uint64[0/1] to correct this behaviour. Resolves: Coverity CID 1660876 Fixes: 2f6da91e8a ("accel/mshv: store partition proc features") Signed-off-by: Magnus Kulke Reviewed-by: Doru Blânzeanu Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Peter Maydell Message-ID: <20260701130335.418156-1-magnuskulke@linux.microsoft.com> Signed-off-by: Philippe Mathieu-Daudé --- accel/mshv/mshv-all.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c index 1959baf667..72721d0f0d 100644 --- a/accel/mshv/mshv-all.c +++ b/accel/mshv/mshv-all.c @@ -167,7 +167,7 @@ static int get_proc_features(int vm_fd, ret = get_partition_property(vm_fd, HV_PARTITION_PROPERTY_PROCESSOR_FEATURES0, - features[0].as_uint64); + &features->as_uint64[0]); if (ret < 0) { error_report("Failed to get processor features bank 0"); return -1; @@ -175,7 +175,7 @@ static int get_proc_features(int vm_fd, ret = get_partition_property(vm_fd, HV_PARTITION_PROPERTY_PROCESSOR_FEATURES1, - features[1].as_uint64); + &features->as_uint64[1]); if (ret < 0) { error_report("Failed to get processor features bank 1"); return -1;