b88cfee902
In pl011_get_baudrate(), when we calculate the baudrate we can
accidentally divide by zero. This happens because although (as the
specification requires) we treat UARTIBRD = 0 as invalid, we aren't
correctly limiting UARTIBRD and UARTFBRD values to the 16-bit and 6-bit
ranges the hardware allows, and so some non-zero values of UARTIBRD can
result in a zero divisor.
Enforce the correct register field widths on guest writes and on inbound
migration to avoid the division by zero.
ASAN log:
==2973125==ERROR: AddressSanitizer: FPE on unknown address 0x55f72629b348
(pc 0x55f72629b348 bp 0x7fffa24d0e00 sp 0x7fffa24d0d60 T0)
#0 0x55f72629b348 in pl011_get_baudrate hw/char/pl011.c:255:17
#1 0x55f726298d94 in pl011_trace_baudrate_change hw/char/pl011.c:260:33
#2 0x55f726296fc8 in pl011_write hw/char/pl011.c:378:9
Reproducer:
cat << EOF | qemu-system-aarch64 -display \
none -machine accel=qtest, -m 512M -machine realview-pb-a8 -qtest stdio
writeq 0x1000b024 0xf8000000
EOF
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240702155752.3022007-1-zheyuma97@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
||
|---|---|---|
| .. | ||
| avr_usart.c | ||
| bcm2835_aux.c | ||
| cadence_uart.c | ||
| cmsdk-apb-uart.c | ||
| debugcon.c | ||
| digic-uart.c | ||
| escc.c | ||
| etraxfs_ser.c | ||
| exynos4210_uart.c | ||
| goldfish_tty.c | ||
| grlib_apbuart.c | ||
| ibex_uart.c | ||
| imx_serial.c | ||
| ipoctal232.c | ||
| Kconfig | ||
| mcf_uart.c | ||
| mchp_pfsoc_mmuart.c | ||
| meson.build | ||
| nrf51_uart.c | ||
| omap_uart.c | ||
| parallel-isa.c | ||
| parallel.c | ||
| pl011.c | ||
| renesas_sci.c | ||
| riscv_htif.c | ||
| sclpconsole-lm.c | ||
| sclpconsole.c | ||
| serial-isa.c | ||
| serial-pci-multi.c | ||
| serial-pci.c | ||
| serial.c | ||
| sh_serial.c | ||
| shakti_uart.c | ||
| sifive_uart.c | ||
| spapr_vty.c | ||
| stm32f2xx_usart.c | ||
| stm32l4x5_usart.c | ||
| terminal3270.c | ||
| trace-events | ||
| trace.h | ||
| virtio-console.c | ||
| virtio-serial-bus.c | ||
| xen_console.c | ||
| xilinx_uartlite.c | ||