[xen staging] AMD/IOMMU: avoid UB in guest CR3 retrieval

[patchbot@xxxxxxx]

commit 846d22d54f24f336fb80d052338e0cd030d54fee
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Nov 20 08:28:58 2020 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Nov 20 08:28:58 2020 +0100

    AMD/IOMMU: avoid UB in guest CR3 retrieval
    
    Found by looking for patterns similar to the one Julien did spot in
    pci_vtd_quirks(). (Not that it matters much here, considering the code
    is dead right now.)
    
    Fixes: 3a7947b69011 ("amd-iommu: use a bitfield for DTE")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/drivers/passthrough/amd/iommu_guest.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/drivers/passthrough/amd/iommu_guest.c 
b/xen/drivers/passthrough/amd/iommu_guest.c
index 30b7353cd6..2a3def9a5d 100644
--- a/xen/drivers/passthrough/amd/iommu_guest.c
+++ b/xen/drivers/passthrough/amd/iommu_guest.c
@@ -70,7 +70,8 @@ static void guest_iommu_disable(struct guest_iommu *iommu)
 
 static uint64_t get_guest_cr3_from_dte(struct amd_iommu_dte *dte)
 {
-    return ((dte->gcr3_trp_51_31 << 31) | (dte->gcr3_trp_30_15 << 15) |
+    return (((uint64_t)dte->gcr3_trp_51_31 << 31) |
+            (dte->gcr3_trp_30_15 << 15) |
             (dte->gcr3_trp_14_12 << 12)) >> PAGE_SHIFT;
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging