Commit c3a68dfd19 for qemu.org

commit c3a68dfd191682b140951e423b72866102097df9
Author: Anastasia Belova <abelova@astralinux.ru>
Date:   Tue Apr 9 14:53:01 2024 +0300

    hw/dma: avoid apparent overflow in soc_dma_set_request

    In soc_dma_set_request() we try to set a bit in a uint64_t, but we
    do it with "1 << ch->num", which can't set any bits past 31;
    any use for a channel number of 32 or more would fail due to
    integer overflow.

    This doesn't happen in practice for our current use of this code,
    because the worst case is when we call soc_dma_init() with an
    argument of 32 for the number of channels, and QEMU builds with
    -fwrapv so the shift into the sign bit is well-defined. However,
    it's obviously not the intended behaviour of the code.

    Add casts to force the shift to be done as 64-bit arithmetic,
    allowing up to 64 channels.

    Found by Linux Verification Center (linuxtesting.org) with SVACE.

    Fixes: afbb5194d4 ("Handle on-chip DMA controllers in one place, convert OMAP DMA to use it.")
    Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
    Message-id: 20240409115301.21829-1-abelova@astralinux.ru
    [PMM: Edit commit message to clarify that this doesn't actually
     bite us in our current usage of this code.]
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/hw/dma/soc_dma.c b/hw/dma/soc_dma.c
index 3a430057f5..d5c52b804f 100644
--- a/hw/dma/soc_dma.c
+++ b/hw/dma/soc_dma.c
@@ -209,9 +209,9 @@ void soc_dma_set_request(struct soc_dma_ch_s *ch, int level)
     dma->enabled_count += level - ch->enable;

     if (level)
-        dma->ch_enable_mask |= 1 << ch->num;
+        dma->ch_enable_mask |= (uint64_t)1 << ch->num;
     else
-        dma->ch_enable_mask &= ~(1 << ch->num);
+        dma->ch_enable_mask &= ~((uint64_t)1 << ch->num);

     if (level != ch->enable) {
         soc_dma_ch_freq_update(dma);