[v1] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()

[PATCH] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()

David Hoppenbrouwers posted 1 patch 4 years, 5 months ago

Diff against v2 v3
Download mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20210816173035.5165-1-david@salt-inc.org

Maintainers: Palmer Dabbelt <palmer@dabbelt.com>, Bin Meng <bin.meng@windriver.com>, Alistair Francis <Alistair.Francis@wdc.com>

There is a newer version of this series

hw/intc/sifive_clint.c | 2 ++
1 file changed, 2 insertions(+)

Expand all Fold all

[PATCH] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()

Posted by David Hoppenbrouwers 4 years, 5 months ago

`next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
resulted in high values such as `UINT64_MAX` being converted to `-1`,
which caused an immediate timer interrupt.

By limiting `next` to `INT64_MAX` no overflow will happen while the
timer will still be effectively set to "infinitely" far in the future.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
---
 hw/intc/sifive_clint.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
index 0f41e5ea1c..e65e71e5ec 100644
--- a/hw/intc/sifive_clint.c
+++ b/hw/intc/sifive_clint.c
@@ -61,6 +61,8 @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
     /* back to ns (note args switched in muldiv64) */
     next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
         muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
+    /* ensure next does not overflow, as timer_mod takes a signed value */
+    next = MAX(next, INT64_MAX);
     timer_mod(cpu->env.timer, next);
 }
 
-- 
2.20.1