[for,2.8,v4,1/1] cadence_uart: Check baud rate generator and divider values on migration

Commit Message

Alistair Francis Dec. 7, 2016, 5:53 p.m. UTC

The Cadence UART device emulator calculates speed by dividing the
baud rate by a 'baud rate generator' & 'baud rate divider' value.
The device specification defines these register values to be
non-zero and within certain limits. Checks were recently added when
writing to these registers but not when restoring from migration.

This patch adds checks when restoring from migration to avoid divide by
zero errors.

Reported-by: Huawei PSIRT <[e-mail]>
Signed-off-by: Alistair Francis <[e-mail]>
---
V4:
 - Fix R_BRGR logic
V3:
 - Fix broken migration logic
 - Manually double checked and it passes migration.
V2:
 - Abort the migration if the data is invalid

 hw/char/cadence_uart.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Peter Maydell Dec. 13, 2016, 12:26 p.m. UTC | #1

On 7 December 2016 at 17:53, Alistair Francis
<[e-mail]> wrote:
> The Cadence UART device emulator calculates speed by dividing the
> baud rate by a 'baud rate generator' & 'baud rate divider' value.
> The device specification defines these register values to be
> non-zero and within certain limits. Checks were recently added when
> writing to these registers but not when restoring from migration.
>
> This patch adds checks when restoring from migration to avoid divide by
> zero errors.
>
> Reported-by: Huawei PSIRT <[e-mail]>
> Signed-off-by: Alistair Francis <[e-mail]>



Applied to target-arm.next for 2.9, thanks.

-- PMM

Patch

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index 0215d65..dba1c53 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -502,6 +502,13 @@  static int cadence_uart_post_load(void *opaque, int version_id)
 {
     CadenceUARTState *s = opaque;
 
+    /* Ensure these two aren't invalid numbers */
+    if (s->r[R_BRGR] < 1 || s->r[R_BRGR] & ~0xFFFF ||
+        s->r[R_BDIV] <= 3 || s->r[R_BDIV] & ~0xFF) {
+        /* Value is invalid, abort */
+        return 1;
+    }
+
     uart_parameters_setup(s);
     uart_update_status(s);
     return 0;