[Qemu-devel] [PATCH] char: serial: check divider value against baud base

[Qemu-devel] [PATCH] char: serial: check divider value against baud base

[P J P]

From: Prasad J Pandit <pjp@fedoraproject.org>

16550A UART device uses an oscillator to generate frequencies
(baud base), which decide communication speed. This speed could
be changed by dividing it by a divider. If the divider is
greater than the baud base, speed is set to zero, leading to a
divide by zero error. Add check to avoid it.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/char/serial.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/serial.c b/hw/char/serial.c
index 3442f47..f659bbd 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -153,7 +153,7 @@ static void serial_update_parameters(SerialState *s)
     int speed, parity, data_bits, stop_bits, frame_size;
     QEMUSerialSetParams ssp;
 
-    if (s->divider == 0)
+    if (s->divider == 0 || s->divider > s->baudbase)
         return;
 
     /* Start bit. */
-- 
2.5.5

Re: [Qemu-devel] [PATCH] char: serial: check divider value against baud base

[no-reply]

Hi,

Your series seems to have some coding style problems. See output below for
more information:

Subject: [Qemu-devel] [PATCH] char: serial: check divider value against baud base
Message-id: 1476203260-5290-1-git-send-email-ppandit@redhat.com
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

# Useful git options
git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git show --no-patch --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
7aea007 char: serial: check divider value against baud base

=== OUTPUT BEGIN ===
Checking PATCH 1/1: char: serial: check divider value against baud base...
ERROR: braces {} are necessary for all arms of this statement
#25: FILE: hw/char/serial.c:156:
+    if (s->divider == 0 || s->divider > s->baudbase)
[...]

total: 1 errors, 0 warnings, 8 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org

Re: [Qemu-devel] [PATCH] char: serial: check divider value against baud base

[P J P]

+-- On Tue, 11 Oct 2016, no-reply@ec2-52-6-146-230.compute-1.amazonaws.com wrote --+
| Your series seems to have some coding style problems.
| === OUTPUT BEGIN ===
| Checking PATCH 1/1: char: serial: check divider value against baud base...
| ERROR: braces {} are necessary for all arms of this statement
| #25: FILE: hw/char/serial.c:156:
| +    if (s->divider == 0 || s->divider > s->baudbase)
| [...]
| 
| Your patch has style problems, please review.

Ah sorry, I've sent a corrected patch v2.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Re: [Qemu-devel] [PATCH] char: serial: check divider value against baud base

[Huawei PSIRT]

Dear,

Thank you very much for your support. And will you assign a CVE-ID for the
issue?

Best regards,
Huawei PSIRT

-----邮件原件-----
发件人: P J P [mailto:ppandit@redhat.com] 
发送时间: 2016年10月12日 0:28
收件人: Qemu Developers
抄送: Michael S. Tsirkin; Paolo Bonzini; Huawei PSIRT; Prasad J Pandit
主题: [PATCH] char: serial: check divider value against baud base

From: Prasad J Pandit <pjp@fedoraproject.org>

16550A UART device uses an oscillator to generate frequencies (baud base),
which decide communication speed. This speed could be changed by dividing it
by a divider. If the divider is greater than the baud base, speed is set to
zero, leading to a divide by zero error. Add check to avoid it.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/char/serial.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/serial.c b/hw/char/serial.c index 3442f47..f659bbd
100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -153,7 +153,7 @@ static void serial_update_parameters(SerialState *s)
     int speed, parity, data_bits, stop_bits, frame_size;
     QEMUSerialSetParams ssp;
 
-    if (s->divider == 0)
+    if (s->divider == 0 || s->divider > s->baudbase)
         return;
 
     /* Start bit. */
--
2.5.5