File CVE-2016-8667-qemut-dma-rc4030-divide-by-zero-e... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-8667-qemut-dma-rc4030-divide-by-zero-error-in-set_next_tick.patch of Package xen (Revision 1b2b5cfb3d6c994be102f9e7e1e3a830)

Currently displaying revision 1b2b5cfb3d6c994be102f9e7e1e3a830 , Show latest

References: bsc#1005004 CVE-2016-8667

The JAZZ RC4030 chipset emulator has a periodic timer and
associated interval reload register. The reload value is used
as divider when computing timer's next tick value. If reload
value is large, it could lead to divide by zero error. Limit
the interval reload value to avoid it.

Reported-by: Huawei PSIRT <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
 hw/dma/rc4030.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: xen-4.7.0-testing/tools/qemu-xen-traditional-dir-remote/hw/rc4030.c
===================================================================
--- xen-4.7.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rc4030.c
+++ xen-4.7.0-testing/tools/qemu-xen-traditional-dir-remote/hw/rc4030.c
@@ -366,7 +366,7 @@ static void rc4030_writel(void *opaque,
         break;
     /* Interval timer reload */
     case 0x0228:
-        s->itr = val;
+        s->itr = val & 0x01FF;
         qemu_irq_lower(s->timer_irq);
         set_next_tick(s);
         break;

Places

File CVE-2016-8667-qemut-dma-rc4030-divide-by-zero-error-in-set_next_tick.patch of Package xen (Revision 1b2b5cfb3d6c994be102f9e7e1e3a830)

Places