[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 01/25] cadence_uart: Check baud rate generator and di
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 01/25] cadence_uart: Check baud rate generator and divider values on migration |
Date: |
Tue, 27 Dec 2016 15:20:53 +0000 |
From: Alistair Francis <address@hidden>
The Cadence UART device emulator calculates speed by dividing the
baud rate by a 'baud rate generator' & 'baud rate divider' value.
The device specification defines these register values to be
non-zero and within certain limits. Checks were recently added when
writing to these registers but not when restoring from migration.
This patch adds checks when restoring from migration to avoid divide by
zero errors.
Reported-by: Huawei PSIRT <address@hidden>
Signed-off-by: Alistair Francis <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
hw/char/cadence_uart.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 0215d65..dba1c53 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -502,6 +502,13 @@ static int cadence_uart_post_load(void *opaque, int
version_id)
{
CadenceUARTState *s = opaque;
+ /* Ensure these two aren't invalid numbers */
+ if (s->r[R_BRGR] < 1 || s->r[R_BRGR] & ~0xFFFF ||
+ s->r[R_BDIV] <= 3 || s->r[R_BDIV] & ~0xFF) {
+ /* Value is invalid, abort */
+ return 1;
+ }
+
uart_parameters_setup(s);
uart_update_status(s);
return 0;
--
2.7.4
- [Qemu-devel] [PULL 00/25] target-arm queue, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 01/25] cadence_uart: Check baud rate generator and divider values on migration,
Peter Maydell <=
- [Qemu-devel] [PULL 02/25] cadence_uart: Check if receiver timeout counter is disabled, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 03/25] Correct value of ARM Cortex-A8 MVFR1 register., Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 04/25] target-arm: Fix aarch64 vec_reg_offset, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 05/25] target-arm: Fix aarch64 disas_ldst_single_struct, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 06/25] hw/intc/arm_gicv3_common: fix aff3 in typer, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 07/25] target-arm: Log AArch64 exception returns, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 08/25] hw/intc/arm_gicv3: Remove incorrect usage of fieldoffset, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 09/25] hw/intc/arm_gicv3: Don't signal Pending+Active interrupts to CPU, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 10/25] hw/arm/virt: add 2.9 machine type, Peter Maydell, 2016/12/27
- [Qemu-devel] [PULL 11/25] m25p80: add support for the mx66l1g45g, Peter Maydell, 2016/12/27