| commit | 146871c33eb70ca7090a0a55e69e5a8f9b5eb102 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Fri, 27 Jan 2017 15:20:25 +0000 (27 15:20 +0000) | ||
| committer | Peter Maydell <peter.maydell@linaro.org> | |
| Fri, 27 Jan 2017 15:29:08 +0000 (27 15:29 +0000) | ||
| tree | 49cee75212273c64026621f51e499deaaf3dec15 | treesnapshot (tar.gz zip) |
| parent | d87576e38df760ef1cb635197d51f207e2a8eda9 | commitdiff |
dma: omap: check dma channel data_type
When setting dma channel 'data_type', if (value & 3) == 3,
the set 'data_type' is said to be bad. This also leads to an
OOB access in 'omap_dma_transfer_generic', while doing
cpu_physical_memory_r/w operations. Add check to avoid it.
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170127120528.30959-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
When setting dma channel 'data_type', if (value & 3) == 3,
the set 'data_type' is said to be bad. This also leads to an
OOB access in 'omap_dma_transfer_generic', while doing
cpu_physical_memory_r/w operations. Add check to avoid it.
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170127120528.30959-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| hw/dma/omap_dma.c | diffblobblamehistory |