[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDI
From: |
Alistair Francis |
Subject: |
Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings |
Date: |
Wed, 15 Mar 2023 10:04:08 +1000 |
On Wed, Mar 15, 2023 at 3:09 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The cadence UART attempts to avoid allowing the guset to set invalid
> baud rate register values in the uart_write() function. However it
> does the "mask to the size of the register field" and "check for
> invalid values" in the wrong order, which means that a malicious
> guest can get a bogus value into the register by setting also some
> high bits in the value, and cause QEMU to crash by division-by-zero.
>
> Do the mask before the bounds check instead of afterwards.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> hw/char/cadence_uart.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
> index c069a30842e..807e3985419 100644
> --- a/hw/char/cadence_uart.c
> +++ b/hw/char/cadence_uart.c
> @@ -450,13 +450,15 @@ static MemTxResult uart_write(void *opaque, hwaddr
> offset,
> }
> break;
> case R_BRGR: /* Baud rate generator */
> + value &= 0xffff;
> if (value >= 0x01) {
> - s->r[offset] = value & 0xFFFF;
> + s->r[offset] = value;
> }
> break;
> case R_BDIV: /* Baud rate divider */
> + value &= 0xff;
> if (value >= 0x04) {
> - s->r[offset] = value & 0xFF;
> + s->r[offset] = value;
> }
> break;
> default:
> --
> 2.34.1
>
>
- [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Peter Maydell, 2023/03/14
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Thomas Huth, 2023/03/14
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Edgar E. Iglesias, 2023/03/14
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Wilfred Mallawa, 2023/03/14
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings,
Alistair Francis <=
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Philippe Mathieu-Daudé, 2023/03/15
- Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings, Qiang Liu, 2023/03/15