[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV setting
From: |
Peter Maydell |
Subject: |
[PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings |
Date: |
Tue, 21 Mar 2023 13:20:30 +0000 |
The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function. However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.
Do the mask before the bounds check instead of afterwards.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
---
hw/char/cadence_uart.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index c069a30842e..807e3985419 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -450,13 +450,15 @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
}
break;
case R_BRGR: /* Baud rate generator */
+ value &= 0xffff;
if (value >= 0x01) {
- s->r[offset] = value & 0xFFFF;
+ s->r[offset] = value;
}
break;
case R_BDIV: /* Baud rate divider */
+ value &= 0xff;
if (value >= 0x04) {
- s->r[offset] = value & 0xFF;
+ s->r[offset] = value;
}
break;
default:
--
2.34.1
- [PULL 0/8] target-arm queue, Peter Maydell, 2023/03/21
- [PULL 1/8] target/arm: Add Neoverse-N1 registers, Peter Maydell, 2023/03/21
- [PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings,
Peter Maydell <=
- [PULL 3/8] contrib/elf2dmp: fix code style, Peter Maydell, 2023/03/21
- [PULL 4/8] contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry, Peter Maydell, 2023/03/21
- [PULL 5/8] contrib/elf2dmp: add PE name check and Windows Server 2022 support, Peter Maydell, 2023/03/21
- [PULL 6/8] hw/usb/imx: Fix out of bounds access in imx_usbphy_read(), Peter Maydell, 2023/03/21
- [PULL 8/8] target/arm: Don't advertise aarch64-pauth.xml to gdb, Peter Maydell, 2023/03/21
- [PULL 7/8] docs/system/arm/cpu-features.rst: Fix formatting, Peter Maydell, 2023/03/21
- Re: [PULL 0/8] target-arm queue, Peter Maydell, 2023/03/21