diff options
| author | Alistair Francis <alistair.francis@xilinx.com> | 2016-12-27 14:59:22 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2016-12-27 14:59:22 +0000 |
| commit | 450aaae8638e4c75ac6547ce6e09d63281a5a925 (patch) | |
| tree | 4edb7705b6150b2bfcfd7c9195e3282970b577ea | |
| parent | a470b33259bf82ef2336bfcd5d07640562d3f63b (diff) | |
| download | focaccia-qemu-450aaae8638e4c75ac6547ce6e09d63281a5a925.tar.gz focaccia-qemu-450aaae8638e4c75ac6547ce6e09d63281a5a925.zip | |
cadence_uart: Check baud rate generator and divider values on migration
The Cadence UART device emulator calculates speed by dividing the baud rate by a 'baud rate generator' & 'baud rate divider' value. The device specification defines these register values to be non-zero and within certain limits. Checks were recently added when writing to these registers but not when restoring from migration. This patch adds checks when restoring from migration to avoid divide by zero errors. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 04ae30ed8ee1758cd2d2af880da4d28f74c67738.1481132150.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/char/cadence_uart.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index 0215d6518d..dba1c53586 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -502,6 +502,13 @@ static int cadence_uart_post_load(void *opaque, int version_id) { CadenceUARTState *s = opaque; + /* Ensure these two aren't invalid numbers */ + if (s->r[R_BRGR] < 1 || s->r[R_BRGR] & ~0xFFFF || + s->r[R_BDIV] <= 3 || s->r[R_BDIV] & ~0xFF) { + /* Value is invalid, abort */ + return 1; + } + uart_parameters_setup(s); uart_update_status(s); return 0; |