system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-10-05 02:29:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
qemu/hw
History
Anastasia Belova c3a68dfd19 hw/dma: avoid apparent overflow in soc_dma_set_request 
In soc_dma_set_request() we try to set a bit in a uint64_t, but we
do it with "1 << ch->num", which can't set any bits past 31;
any use for a channel number of 32 or more would fail due to
integer overflow.

This doesn't happen in practice for our current use of this code,
because the worst case is when we call soc_dma_init() with an
argument of 32 for the number of channels, and QEMU builds with
-fwrapv so the shift into the sign bit is well-defined. However,
it's obviously not the intended behaviour of the code.

Add casts to force the shift to be done as 64-bit arithmetic,
allowing up to 64 channels.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: afbb5194d4 ("Handle on-chip DMA controllers in one place, convert OMAP DMA to use it.")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Message-id: 20240409115301.21829-1-abelova@astralinux.ru
[PMM: Edit commit message to clarify that this doesn't actually
 bite us in our current usage of this code.]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-25 10:21:06 +01:00
..
9pfs * configure: use a native non-cross compiler for linux-user 2024-01-04 19:55:20 +00:00
acpi hmat acpi: Fix out of bounds access due to missing use of indirection 2024-03-12 17:59:46 -04:00
adc hw/adc: Constify VMState 2023-12-29 11:17:30 +11:00
alpha hw/alpha/dp264: use pci_init_nic_devices() 2024-02-02 16:23:47 +00:00
arm hw/arm/virt: Enable NMI support in the GIC if the CPU has FEAT_NMI 2024-04-25 10:21:06 +01:00
audio hw/audio/virtio-snd: Remove unused assignment 2024-04-10 11:07:37 +02:00
avr hw/avr/atmega: Fix wrong initial value of stack pointer 2023-11-28 14:27:12 +01:00
block hw/block/nand: Fix out-of-bound access in NAND block buffer 2024-04-10 09:09:34 +02:00
char hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs 2024-04-10 09:09:33 +02:00
core Removal of deprecated code 2024-04-24 11:49:57 -07:00
cpu target/arm: Move GTimer definitions to new 'gtimer.h' header 2024-01-26 11:30:49 +00:00
cris hw/net/etraxfs-eth: use qemu_configure_nic_device() 2024-02-02 16:23:47 +00:00
cxl hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config() 2024-03-12 17:56:55 -04:00
display vga: move dirty memory region code together 2024-04-18 11:17:27 +02:00
dma hw/dma: avoid apparent overflow in soc_dma_set_request 2024-04-25 10:21:06 +01:00
fsi hw/fsi: Aspeed APB2OPB & On-chip peripheral bus 2024-02-01 08:33:18 +01:00
gpio * Fix timeouts in Travis-CI jobs 2024-03-25 14:19:42 +00:00
hppa hw/hppa: do not require CONFIG_USB 2024-02-27 09:37:13 +01:00
hyperv vmbus: Print a warning when enabled without the recommended set of features 2024-03-08 14:18:56 +01:00
i2c hw/i2c: Implement Broadcom Serial Controller (BSC) 2024-03-05 13:22:55 +00:00
i386 Migration pull for 9.1 2024-04-23 21:32:22 -07:00
ide hw/ide/ahci: Rename ahci_internal.h to ahci-internal.h 2024-03-11 22:09:42 +01:00
input hw/input/pckbd: Open-code i8042_setup_a20_line() wrapper 2024-02-22 12:47:35 +01:00
intc hw/intc/arm_gicv3: Report the VINMI interrupt 2024-04-25 10:21:05 +01:00
ipack hw/ipack: Constify VMState 2023-12-29 11:17:30 +11:00
ipmi hw/ipmi: Constify VMState 2023-12-29 11:17:30 +11:00
isa hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately 2024-04-15 13:07:11 +02:00
loongarch smbios: get rid of global smbios_ep_type 2024-03-18 08:42:45 -04:00
m68k hw: Add compat machines for 9.1 2024-04-18 11:17:28 +02:00
mem memory-device: move stubs out of stubs/ 2024-04-18 11:17:27 +02:00
microblaze hw/microblaze: Do not allow xlnx-zynqmp-pmu-soc to be created by the user 2024-03-25 09:57:43 +01:00
mips mips: do not list individual devices from configs/ 2024-03-08 15:51:22 +01:00
misc hw/misc/applesmc: Fix memory leak in reset() handler 2024-04-10 09:09:34 +02:00
net hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() 2024-04-10 10:43:54 +02:00
nubus hw/nubus: add nubus-virtio-mmio device 2024-02-27 09:36:39 +01:00
nvme hw/nvme: fix -Werror=maybe-uninitialized 2024-04-02 16:15:07 +02:00
nvram hw/nvram/mac_nvram: Report failure to write data 2024-03-25 10:41:01 +00:00
openrisc hw/openrisc/openrisc_sim: use qemu_create_nic_device() 2024-02-02 16:23:47 +00:00
pci virtio,pc,pci: features, cleanups, fixes 2024-03-13 15:11:53 +00:00
pci-bridge virtio,pc,pci: features, cleanups, fixes 2024-03-13 15:11:53 +00:00
pci-host q35: Introduce smm_ranges property for q35-pci-host 2024-04-23 17:35:25 +02:00
pcmcia hw/pcmcia/pxa2xx: Inline pxa2xx_pcmcia_init() 2023-10-27 12:48:57 +01:00
ppc Error reporting patches for 2024-04-24 2024-04-24 09:22:42 -07:00
remote hw/remote/remote-obj: hw/misc/ivshmem: Fix missing ERRP_GUARD() for error_prepend() 2024-03-09 18:51:45 +01:00
riscv target/riscv/kvm: fix timebase-frequency when using KVM acceleration 2024-03-22 15:41:01 +10:00
rtc hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later 2024-03-07 12:54:56 +00:00
rx hw/rx/rx62n: Only call qdev_get_gpio_in() when necessary 2024-02-15 16:58:46 +01:00
s390x Migration pull for 9.1 2024-04-23 21:32:22 -07:00
scsi esp.c: remove explicit setting of DRQ within ESP state machine 2024-04-04 15:17:53 +01:00
sd hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set 2024-04-10 09:09:34 +02:00
sensor hw/sensor: Constify VMState 2023-12-30 07:38:06 +11:00
sh4 hw/usb: extract sysbus-ohci to a separate file 2024-02-27 09:37:25 +01:00
smbios hw/smbios: add stub for smbios_get_table_legacy() 2024-03-26 14:32:54 +01:00
sparc hw/sparc/leon3: Fix wrong usage of DO_UPCAST macro 2024-02-22 12:47:40 +01:00
sparc64 sun4u: remap ebus BAR0 to use unassigned_io_ops instead of alias to PCI IO space 2024-03-11 22:10:18 +01:00
ssi aspeed/smc: Only wire flash devices at reset 2024-03-19 11:58:15 +01:00
timer hw/timer: Remove the ALTERA_TIMER model 2024-04-24 16:03:38 +02:00
tpm hw/tpm: Remove HOST_PAGE_ALIGN from tpm_ppi_init 2024-02-29 11:35:36 -10:00
tricore hw/tricore/testboard: Use qdev_new() instead of QOM basic API 2024-02-22 12:47:40 +01:00
ufs hw/ufs: avoid generating the same ID string for different LU devices 2023-12-05 13:57:18 +09:00
usb hw/usb: move stubs out of stubs/ 2024-04-18 11:17:27 +02:00
vfio memory: Add Error** argument to .log_global_start() handler 2024-04-23 18:36:01 -04:00
virtio Migration pull for 9.1 2024-04-23 21:32:22 -07:00
watchdog hw/watchdog: Constify VMState 2023-12-30 07:38:06 +11:00
xen Xen queue: 2024-03-12 21:32:31 +00:00
xenpv hw/xen: use qemu_create_nic_bus_devices() to instantiate Xen NICs 2024-02-02 16:23:47 +00:00
xtensa hw/xtensa/xtfpga: use qemu_create_nic_device() 2024-02-02 16:23:47 +00:00
Kconfig hw/rdma: Remove deprecated pvrdma device and rdmacm-mux helper 2024-04-24 16:03:38 +02:00
meson.build hw/rdma: Remove deprecated pvrdma device and rdmacm-mux helper 2024-04-24 16:03:38 +02:00