Commit 146871c3 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Peter Maydell
Browse files

dma: omap: check dma channel data_type 



When setting dma channel 'data_type', if (value & 3) == 3,
the set 'data_type' is said to be bad. This also leads to an
OOB access in 'omap_dma_transfer_generic', while doing
cpu_physical_memory_r/w operations. Add check to avoid it.

Reported-by: default avatarJiang Xin <jiangxin1@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170127120528.30959-1-ppandit@redhat.com
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent d87576e3

hw/dma/omap_dma.c

+7 −3
Original line number Diff line number Diff line
@@ -878,15 +878,17 @@ static int omap_dma_ch_reg_write(struct omap_dma_s *s, 
        ch->burst[0] = (value & 0x0180) >> 7;

        ch->pack[0] = (value & 0x0040) >> 6;

        ch->port[0] = (enum omap_dma_port) ((value & 0x003c) >> 2);

        ch->data_type = 1 << (value & 3);

        if (ch->port[0] >= __omap_dma_port_last)

            printf("%s: invalid DMA port %i\n", __FUNCTION__,

                            ch->port[0]);

        if (ch->port[1] >= __omap_dma_port_last)

            printf("%s: invalid DMA port %i\n", __FUNCTION__,

                            ch->port[1]);

        if ((value & 3) == 3)

        ch->data_type = 1 << (value & 3);

        if ((value & 3) == 3) {

            printf("%s: bad data_type for DMA channel\n", __FUNCTION__);

            ch->data_type >>= 1;

        }

        break;



    case 0x02:	/* SYS_DMA_CCR_CH0 */
@@ -1988,8 +1990,10 @@ static void omap_dma4_write(void *opaque, hwaddr addr, 
            fprintf(stderr, "%s: bad MReqAddressTranslate sideband signal\n",

                            __FUNCTION__);

        ch->data_type = 1 << (value & 3);

        if ((value & 3) == 3)

        if ((value & 3) == 3) {

            printf("%s: bad data_type for DMA channel\n", __FUNCTION__);

            ch->data_type >>= 1;

        }

        break;



    case 0x14:	/* DMA4_CEN */