70b09a5bad
Update to v2.8.0, including integration of SLE qemu package so we are "Factory First" again for SLE qemu. Includes some spec file tweaks/cleanups as well. A number of post v2.8.0 security fixes are also included. OBS-URL: https://build.opensuse.org/request/show/461715 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=329
33 lines
1.1 KiB
Diff
33 lines
1.1 KiB
Diff
From 920c90f4344b38242bd01b21f8bef55f11d0748c Mon Sep 17 00:00:00 2001
|
|
From: P J P <ppandit@redhat.com>
|
|
Date: Mon, 31 Oct 2016 15:55:14 -0600
|
|
Subject: [PATCH] dma: rc4030: limit interval timer reload value
|
|
|
|
The JAZZ RC4030 chipset emulator has a periodic timer and
|
|
associated interval reload register. The reload value is used
|
|
as divider when computing timer's next tick value. If reload
|
|
value is large, it could lead to divide by zero error. Limit
|
|
the interval reload value to avoid it.
|
|
|
|
Reported-by: Huawei PSIRT <psirt@huawei.com>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
[BR: CVE-2016-8667 BSC#1004702]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/dma/rc4030.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/dma/rc4030.c b/hw/dma/rc4030.c
|
|
index 17c8518fea..41fc043464 100644
|
|
--- a/hw/dma/rc4030.c
|
|
+++ b/hw/dma/rc4030.c
|
|
@@ -460,7 +460,7 @@ static void rc4030_write(void *opaque, hwaddr addr, uint64_t data,
|
|
break;
|
|
/* Interval timer reload */
|
|
case 0x0228:
|
|
- s->itr = val;
|
|
+ s->itr = val & 0x01FF;
|
|
qemu_irq_lower(s->timer_irq);
|
|
set_next_tick(s);
|
|
break;
|