diff options
| author | Zheyu Ma <zheyuma97@gmail.com> | 2024-07-02 17:57:52 +0200 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2024-07-11 11:41:33 +0100 |
| commit | b88cfee90268cad376682da8f99ccf024d7aa304 (patch) | |
| tree | d95e66f7cdd2130e8d2b535ccee67d6020430ae1 /hw/char | |
| parent | a8ab8706d4cc461481ce419e62e3ad48b03638a8 (diff) | |
| download | qemu-b88cfee90268cad376682da8f99ccf024d7aa304.zip qemu-b88cfee90268cad376682da8f99ccf024d7aa304.tar.gz qemu-b88cfee90268cad376682da8f99ccf024d7aa304.tar.bz2 | |
hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()
In pl011_get_baudrate(), when we calculate the baudrate we can
accidentally divide by zero. This happens because although (as the
specification requires) we treat UARTIBRD = 0 as invalid, we aren't
correctly limiting UARTIBRD and UARTFBRD values to the 16-bit and 6-bit
ranges the hardware allows, and so some non-zero values of UARTIBRD can
result in a zero divisor.
Enforce the correct register field widths on guest writes and on inbound
migration to avoid the division by zero.
ASAN log:
==2973125==ERROR: AddressSanitizer: FPE on unknown address 0x55f72629b348
(pc 0x55f72629b348 bp 0x7fffa24d0e00 sp 0x7fffa24d0d60 T0)
#0 0x55f72629b348 in pl011_get_baudrate hw/char/pl011.c:255:17
#1 0x55f726298d94 in pl011_trace_baudrate_change hw/char/pl011.c:260:33
#2 0x55f726296fc8 in pl011_write hw/char/pl011.c:378:9
Reproducer:
cat << EOF | qemu-system-aarch64 -display \
none -machine accel=qtest, -m 512M -machine realview-pb-a8 -qtest stdio
writeq 0x1000b024 0xf8000000
EOF
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240702155752.3022007-1-zheyuma97@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/char')
| -rw-r--r-- | hw/char/pl011.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/hw/char/pl011.c b/hw/char/pl011.c index 8753b84..f8078aa 100644 --- a/hw/char/pl011.c +++ b/hw/char/pl011.c @@ -87,6 +87,12 @@ DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr) #define CR_DTR (1 << 10) #define CR_LBE (1 << 7) +/* Integer Baud Rate Divider, UARTIBRD */ +#define IBRD_MASK 0x3f + +/* Fractional Baud Rate Divider, UARTFBRD */ +#define FBRD_MASK 0xffff + static const unsigned char pl011_id_arm[8] = { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 }; static const unsigned char pl011_id_luminary[8] = @@ -374,11 +380,11 @@ static void pl011_write(void *opaque, hwaddr offset, s->ilpr = value; break; case 9: /* UARTIBRD */ - s->ibrd = value; + s->ibrd = value & IBRD_MASK; pl011_trace_baudrate_change(s); break; case 10: /* UARTFBRD */ - s->fbrd = value; + s->fbrd = value & FBRD_MASK; pl011_trace_baudrate_change(s); break; case 11: /* UARTLCR_H */ @@ -531,6 +537,9 @@ static int pl011_post_load(void *opaque, int version_id) s->read_pos = 0; } + s->ibrd &= IBRD_MASK; + s->fbrd &= FBRD_MASK; + return 0; } |