diff options
author | Peter Maydell <peter.maydell@linaro.org> | 2023-03-14 17:08:04 +0000 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2023-03-21 11:54:39 +0000 |
commit | 0c88f93788d33795a4c14a0ca999607a6546f8b8 (patch) | |
tree | 59cc43088c23acbe8dbf743112fe71077c67148b /hw/char | |
parent | 0b903369951cac12ccdfc66a7520b413eca1bb62 (diff) | |
download | qemu-0c88f93788d33795a4c14a0ca999607a6546f8b8.zip qemu-0c88f93788d33795a4c14a0ca999607a6546f8b8.tar.gz qemu-0c88f93788d33795a4c14a0ca999607a6546f8b8.tar.bz2 |
hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function. However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.
Do the mask before the bounds check instead of afterwards.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
Diffstat (limited to 'hw/char')
-rw-r--r-- | hw/char/cadence_uart.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index c069a30..807e398 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -450,13 +450,15 @@ static MemTxResult uart_write(void *opaque, hwaddr offset, } break; case R_BRGR: /* Baud rate generator */ + value &= 0xffff; if (value >= 0x01) { - s->r[offset] = value & 0xFFFF; + s->r[offset] = value; } break; case R_BDIV: /* Baud rate divider */ + value &= 0xff; if (value >= 0x04) { - s->r[offset] = value & 0xFF; + s->r[offset] = value; } break; default: |