mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-10-05 02:29:49 +00:00
c3a68dfd19
In soc_dma_set_request() we try to set a bit in a uint64_t, but we
do it with "1 << ch->num", which can't set any bits past 31;
any use for a channel number of 32 or more would fail due to
integer overflow.
This doesn't happen in practice for our current use of this code,
because the worst case is when we call soc_dma_init() with an
argument of 32 for the number of channels, and QEMU builds with
-fwrapv so the shift into the sign bit is well-defined. However,
it's obviously not the intended behaviour of the code.
Add casts to force the shift to be done as 64-bit arithmetic,
allowing up to 64 channels.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes:
|
||
|---|---|---|
| .. | ||
| bcm2835_dma.c | ||
| etraxfs_dma.c | ||
| i8257.c | ||
| i82374.c | ||
| Kconfig | ||
| meson.build | ||
| omap_dma.c | ||
| pl080.c | ||
| pl330.c | ||
| pxa2xx_dma.c | ||
| rc4030.c | ||
| sifive_pdma.c | ||
| soc_dma.c | ||
| sparc32_dma.c | ||
| trace-events | ||
| trace.h | ||
| xilinx_axidma.c | ||
| xlnx-zdma.c | ||
| xlnx-zynq-devcfg.c | ||
| xlnx_csu_dma.c | ||
| xlnx_dpdma.c | ||