From patchwork Wed Oct 12 12:37:41 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Prasad Pandit X-Patchwork-Id: 9372495 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 632FF60772 for ; Wed, 12 Oct 2016 12:38:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5467629203 for ; Wed, 12 Oct 2016 12:38:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4921D2959A; Wed, 12 Oct 2016 12:38:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9CAF529203 for ; Wed, 12 Oct 2016 12:38:28 +0000 (UTC) Received: from localhost ([::1]:33293 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buInj-0007lG-Iy for patchwork-qemu-devel@patchwork.kernel.org; Wed, 12 Oct 2016 08:38:27 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36851) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buInB-0007i4-Cp for qemu-devel@nongnu.org; Wed, 12 Oct 2016 08:37:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1buIn6-0005DF-2M for qemu-devel@nongnu.org; Wed, 12 Oct 2016 08:37:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33162) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buIn5-0005D4-S1 for qemu-devel@nongnu.org; Wed, 12 Oct 2016 08:37:47 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0BBAB4E33A; Wed, 12 Oct 2016 12:37:47 +0000 (UTC) Received: from javelin.localdomain (vpn1-4-55.sin2.redhat.com [10.67.4.55]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9CCbg0U016526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 12 Oct 2016 08:37:44 -0400 From: P J P To: Qemu Developers Date: Wed, 12 Oct 2016 18:07:41 +0530 Message-Id: <1476275861-27613-1-git-send-email-ppandit@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Wed, 12 Oct 2016 12:37:47 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] dma: rc4030: limit interval timer reload value X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Huawei PSIRT , Prasad J Pandit , "Michael S. Tsirkin" Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit The JAZZ RC4030 chipset emulator has a periodic timer and associated interval reload register. The reload value is used as divider when computing timer's next tick value. If reload value is large, it could lead to divide by zero error. Limit the interval reload value to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit Tested-by: Hervé Poussineau --- hw/dma/rc4030.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c index 2f2576f..c1b4997 100644 --- a/hw/dma/rc4030.c +++ b/hw/dma/rc4030.c @@ -460,7 +460,7 @@ static void rc4030_write(void *opaque, hwaddr addr, uint64_t data, break; /* Interval timer reload */ case 0x0228: - s->itr = val; + s->itr = val & 0x01FF; qemu_irq_lower(s->timer_irq); set_next_tick(s); break;