From patchwork Mon Mar 20 13:00:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yongbok Kim X-Patchwork-Id: 9634091 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DE661602D6 for ; Mon, 20 Mar 2017 13:01:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CB57E27F7F for ; Mon, 20 Mar 2017 13:01:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BDA1127F95; Mon, 20 Mar 2017 13:01:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 089DA27F7F for ; Mon, 20 Mar 2017 13:01:54 +0000 (UTC) Received: from localhost ([::1]:32867 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cpwwb-0004PY-36 for patchwork-qemu-devel@patchwork.kernel.org; Mon, 20 Mar 2017 09:01:53 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45719) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cpwvZ-0003wy-9i for qemu-devel@nongnu.org; Mon, 20 Mar 2017 09:00:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cpwvT-00071M-Bc for qemu-devel@nongnu.org; Mon, 20 Mar 2017 09:00:49 -0400 Received: from mailapp01.imgtec.com ([195.59.15.196]:28683) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cpwvT-000715-5c for qemu-devel@nongnu.org; Mon, 20 Mar 2017 09:00:43 -0400 Received: from hhmail02.hh.imgtec.org (unknown [10.100.10.20]) by Forcepoint Email with ESMTPS id D2C0DE9C6D6CB; Mon, 20 Mar 2017 13:00:38 +0000 (GMT) Received: from localhost.localdomain (192.168.161.53) by hhmail02.hh.imgtec.org (10.100.10.21) with Microsoft SMTP Server (TLS) id 14.3.294.0; Mon, 20 Mar 2017 13:00:41 +0000 From: Yongbok Kim To: QEMU Developers Date: Mon, 20 Mar 2017 13:00:23 +0000 Message-ID: <1490014826-4472-8-git-send-email-yongbok.kim@imgtec.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1490014826-4472-1-git-send-email-yongbok.kim@imgtec.com> References: <1490014826-4472-1-git-send-email-yongbok.kim@imgtec.com> MIME-Version: 1.0 X-Originating-IP: [192.168.161.53] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 195.59.15.196 Subject: [Qemu-devel] [PULL for v2.9 07/10] dma: rc4030: limit interval timer reload value X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Prasad J Pandit Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit The JAZZ RC4030 chipset emulator has a periodic timer and associated interval reload register. The reload value is used as divider when computing timer's next tick value. If reload value is large, it could lead to divide by zero error. Limit the interval reload value to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit Tested-by: Hervé Poussineau Signed-off-by: Yongbok Kim --- hw/dma/rc4030.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c index 17c8518..41fc043 100644 --- a/hw/dma/rc4030.c +++ b/hw/dma/rc4030.c @@ -460,7 +460,7 @@ static void rc4030_write(void *opaque, hwaddr addr, uint64_t data, break; /* Interval timer reload */ case 0x0228: - s->itr = val; + s->itr = val & 0x01FF; qemu_irq_lower(s->timer_irq); set_next_tick(s); break;