Re: [PATCH v3] hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()

[Peter Maydell]

On Tue, 2 Jul 2024 at 17:18, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> On 2/7/24 17:57, Zheyu Ma wrote:
> > In pl011_get_baudrate(), when we calculate the baudrate we can
> > accidentally divide by zero. This happens because although (as the
> > specification requires) we treat UARTIBRD = 0 as invalid, we aren't
> > correctly limiting UARTIBRD and UARTFBRD values to the 16-bit and 6-bit
> > ranges the hardware allows, and so some non-zero values of UARTIBRD can
> > result in a zero divisor.
> >
> > Enforce the correct register field widths on guest writes and on inbound
> > migration to avoid the division by zero.
> >
> > ASAN log:
> > ==2973125==ERROR: AddressSanitizer: FPE on unknown address 0x55f72629b348
> > (pc 0x55f72629b348 bp 0x7fffa24d0e00 sp 0x7fffa24d0d60 T0)
> >       #0 0x55f72629b348 in pl011_get_baudrate hw/char/pl011.c:255:17
> >       #1 0x55f726298d94 in pl011_trace_baudrate_change 
> > hw/char/pl011.c:260:33
> >       #2 0x55f726296fc8 in pl011_write hw/char/pl011.c:378:9
> >
> > Reproducer:
> > cat << EOF | qemu-system-aarch64 -display \
> > none -machine accel=qtest, -m 512M -machine realview-pb-a8 -qtest stdio
> > writeq 0x1000b024 0xf8000000
> > EOF
> >
> > Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>
> Peter, feel free to replace that line by:
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

OK; applied to target-arm.next, thanks.

-- PMM