public/qemu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

Browse source 
The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function.  However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.

Do the mask before the bounds check instead of afterwards.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
This commit is contained in:
Peter Maydell 2023-03-14 17:08:04 +00:00
parent 0b90336995
commit 0c88f93788
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
hw/char/cadence_uart.c
View file

@ -450,13 +450,15 @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
}
break;
case R_BRGR: /* Baud rate generator */
value &= 0xffff;
if (value >= 0x01) {
s->r[offset] = value & 0xFFFF;
s->r[offset] = value;
}
break;
case R_BDIV: /* Baud rate divider */
value &= 0xff;
if (value >= 0x04) {
s->r[offset] = value & 0xFF;
s->r[offset] = value;
}
break;
default: