dma: omap: check dma channel data_type
When setting dma channel 'data_type', if (value & 3) == 3, the set 'data_type' is said to be bad. This also leads to an OOB access in 'omap_dma_transfer_generic', while doing cpu_physical_memory_r/w operations. Add check to avoid it. Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170127120528.30959-1-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
parent
d87576e38d
commit
146871c33e
|
@ -878,15 +878,17 @@ static int omap_dma_ch_reg_write(struct omap_dma_s *s,
|
||||||
ch->burst[0] = (value & 0x0180) >> 7;
|
ch->burst[0] = (value & 0x0180) >> 7;
|
||||||
ch->pack[0] = (value & 0x0040) >> 6;
|
ch->pack[0] = (value & 0x0040) >> 6;
|
||||||
ch->port[0] = (enum omap_dma_port) ((value & 0x003c) >> 2);
|
ch->port[0] = (enum omap_dma_port) ((value & 0x003c) >> 2);
|
||||||
ch->data_type = 1 << (value & 3);
|
|
||||||
if (ch->port[0] >= __omap_dma_port_last)
|
if (ch->port[0] >= __omap_dma_port_last)
|
||||||
printf("%s: invalid DMA port %i\n", __FUNCTION__,
|
printf("%s: invalid DMA port %i\n", __FUNCTION__,
|
||||||
ch->port[0]);
|
ch->port[0]);
|
||||||
if (ch->port[1] >= __omap_dma_port_last)
|
if (ch->port[1] >= __omap_dma_port_last)
|
||||||
printf("%s: invalid DMA port %i\n", __FUNCTION__,
|
printf("%s: invalid DMA port %i\n", __FUNCTION__,
|
||||||
ch->port[1]);
|
ch->port[1]);
|
||||||
if ((value & 3) == 3)
|
ch->data_type = 1 << (value & 3);
|
||||||
|
if ((value & 3) == 3) {
|
||||||
printf("%s: bad data_type for DMA channel\n", __FUNCTION__);
|
printf("%s: bad data_type for DMA channel\n", __FUNCTION__);
|
||||||
|
ch->data_type >>= 1;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case 0x02: /* SYS_DMA_CCR_CH0 */
|
case 0x02: /* SYS_DMA_CCR_CH0 */
|
||||||
|
@ -1988,8 +1990,10 @@ static void omap_dma4_write(void *opaque, hwaddr addr,
|
||||||
fprintf(stderr, "%s: bad MReqAddressTranslate sideband signal\n",
|
fprintf(stderr, "%s: bad MReqAddressTranslate sideband signal\n",
|
||||||
__FUNCTION__);
|
__FUNCTION__);
|
||||||
ch->data_type = 1 << (value & 3);
|
ch->data_type = 1 << (value & 3);
|
||||||
if ((value & 3) == 3)
|
if ((value & 3) == 3) {
|
||||||
printf("%s: bad data_type for DMA channel\n", __FUNCTION__);
|
printf("%s: bad data_type for DMA channel\n", __FUNCTION__);
|
||||||
|
ch->data_type >>= 1;
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case 0x14: /* DMA4_CEN */
|
case 0x14: /* DMA4_CEN */
|
||||||
|
|
Loading…
Reference in a new issue