On 10/2/2026 7:33 AM, Alistair Francis wrote:
On Thu, 2026-10-01 at 10:22 +0800, Tao Ding wrote:
Validate the address before subtracting the channel base and use
hwaddr
for channel calculations to prevent unsigned underflow and
truncation.
Thanks for sending fixes. You are missing a cover letter for a multi-
patch series
Resolves: Coverity CID 1685516
Should be 1685514
Yes
Reported-by: Alistair Francis<[email protected]>
Signed-off-by: Tao Ding<[email protected]>
---
hw/dma/k230_gsdma.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/dma/k230_gsdma.c b/hw/dma/k230_gsdma.c
index 7635cd19e8..e9a7877e54 100644
--- a/hw/dma/k230_gsdma.c
+++ b/hw/dma/k230_gsdma.c
@@ -300,7 +300,7 @@ static const VMStateDescription
vmstate_k230_gsdma = {
static uint64_t k230_gsdma_read(void *opaque, hwaddr addr, unsigned
int size)
{
K230GSDMAState *s = K230_GSDMA(opaque);
- unsigned int ch;
+ hwaddr ch;
hwaddr ch_off;
uint64_t ret = 0;
@@ -329,6 +329,9 @@ static uint64_t k230_gsdma_read(void *opaque,
hwaddr addr, unsigned int size)
break;
}
+ if (addr < K230_GSDMA_CH_BASE) {
+ goto out;
+ }
Why add the complexity of a goto? You already have a `addr <
K230_GSDMA_CH_BASE` check (which will never trigger after this change)
where you log an error, just return there.
The use of goto here is intended to skip the following code,
which deals with addresses greater than K230_GSDMA_CH_SASE.
Another way, the trace function can also be called here and returned.
ch = (addr - K230_GSDMA_CH_BASE) / K230_GSDMA_CH_STRIDE;
ch_off = (addr - K230_GSDMA_CH_BASE) % K230_GSDMA_CH_STRIDE;
if (ch < K230_GSDMA_NUM_SDMA_CHANNELS) {
@@ -355,6 +358,7 @@ static uint64_t k230_gsdma_read(void *opaque,
hwaddr addr, unsigned int size)
}
}
+out:
trace_k230_gsdma_read(addr, size, ret);
Why do you want to log a failed read as successful?
I also a bit confused here, whether trace can only record successful reads and
writes.
I think it's better to use trace to record all accesses,
otherwise we would need -d guest_errors to record failed accesses.
Alistair
return ret;
}
