Nicholas Piggin 4d8459c365 target/ppc: Fix decrementer time underflow and infinite timer loop ... It is possible to store a very large value to the decrementer that it does not raise the decrementer exception so the timer is scheduled, but the next time value wraps and is treated as in the past. This can occur if (u64)-1 is stored on a zero-triggered exception, or (u64)-1 is stored twice on an underflow-triggered exception, for example. If such a value is set in DECAR, it gets stored to the decrementer by the timer function, which then immediately causes another timer, which hangs QEMU. Clamp the decrementer to the implemented width, and use that as the value for the timer calculation, effectively preventing this overflow. Reported-by: sdicaro@DDCI.com Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230530131214.373524-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> (cherry picked from commit 09d2db9f46e38e2da990df8ad914d735d764251a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>		2023-06-30 09:18:28 +03:00
..
9pfs	9pfs: prevent opening special files (CVE-2023-2861)	2023-06-08 23:52:29 +03:00
acpi	acpi: pcihp: allow repeating hot-unplug requests	2023-05-18 21:09:41 +03:00
adc	hw/adc: Make adci[*] R/W in NPCM7XX ADC	2022-07-18 13:20:14 +01:00
alpha	hw: Remove unused MAX_IDE_BUS define	2022-10-31 11:32:07 +01:00
arm	hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number	2023-05-31 09:43:56 +03:00
audio	hw/audio/intel-hda: Drop unnecessary prototype	2022-11-23 12:30:45 +01:00
avr	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
block	hw/virtio: generalise CHR_EVENT_CLOSED handling	2022-12-01 02:30:13 -05:00
char	Drop useless casts from g_malloc() & friends to pointer	2022-10-22 23:15:40 +02:00
core	machine: do not crash if default RAM backend name has been stolen	2023-05-28 12:02:26 +03:00
cpu
cris
cxl	hw/cxl/cdat: CXL CDAT Data Object Exchange implementation	2022-11-07 13:12:19 -05:00
display	virtio-gpu: Make non-gl display updates work again when blob=true	2023-06-28 18:52:17 +03:00
dma	hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.	2023-05-31 09:43:56 +03:00
gpio	hw/gpio/meson: Introduce dedicated config switch for hw/gpio/mpc8xxx	2022-10-17 16:15:09 -03:00
hppa	target/hppa: Provide qemu version via fw_cfg to firmware	2023-06-26 19:35:29 +03:00
hyperv	hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()	2022-10-27 10:27:23 +01:00
i2c	hw/i2c/aspeed: Fix old reg slave receive	2022-10-24 11:20:15 +02:00
i386	xen/pt: reserve PCI slot 2 for Intel igd-passthru	2023-05-18 21:09:59 +03:00
ide	hw/ppc/mac.h: Rename to include/hw/nvram/mac_nvram.h	2022-10-31 18:48:23 +00:00
input	pckbd: remove legacy i8042_mm_init() function	2022-07-18 19:28:46 +01:00
intc	hw/intc/allwinner-a10-pic: Handle IRQ levels other than 0 or 1	2023-06-22 10:38:09 +03:00
ipack
ipmi	ipmi:smbus: Add a check around a memcpy	2022-08-01 06:40:50 -05:00
isa	acpi: x86: move RPQx field back to _SB scope	2022-11-22 05:19:00 -05:00
loongarch	Revert "hw/loongarch/virt: Add cfi01 pflash device"	2022-12-05 11:24:35 -05:00
m68k	m68k/q800: do not re-randomize RNG seed on snapshot load	2022-10-27 11:34:31 +01:00
mem	hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange	2022-11-07 13:12:19 -05:00
microblaze	hw/microblaze: pass random seed to fdt	2022-09-21 19:59:56 +02:00
mips	hw/mips/malta: Use bootloader helper to set BAR registers	2022-10-31 11:32:56 +01:00
misc	aspeed/hace: Initialize g_autofree pointer	2023-06-16 16:15:56 +03:00
net	rtl8139: fix large_send_mss divide-by-zero	2023-05-28 12:02:26 +03:00
nios2	hw/nios2: set machine->fdt in nios2_load_dtb()	2022-10-17 16:15:10 -03:00
nubus
nvme	hw/nvme: fix memory leak in nvme_dsm	2023-04-13 18:28:32 +03:00
nvram	Revert "x86: return modified setup_data only if read as memory, not as file"	2023-03-29 10:20:04 +03:00
openrisc	openrisc: re-randomize rng-seed on reboot	2022-10-27 11:34:31 +01:00
pci	msix: Assert that specified vector is in range	2022-11-07 14:08:17 -05:00
pci-bridge	hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE	2022-11-07 13:12:19 -05:00
pci-host	hw/pci-host/pnv_phb: Avoid quitting QEMU if hotplug of pnv-phb-root-port fails	2022-11-10 18:22:10 -03:00
pcmcia
ppc	target/ppc: Fix decrementer time underflow and infinite timer loop	2023-06-30 09:18:28 +03:00
rdma	hw/pvrdma: Protect against buggy or malicious guest driver	2023-03-30 12:19:04 +03:00
remote	hw/remote: Fix vfu_cfg trace offset format	2023-06-11 11:02:28 +03:00
riscv	hw/riscv: qemu crash when NUMA nodes exceed available CPUs	2023-06-14 13:02:36 +03:00
rtc	goldfish_rtc: Add big-endian property	2022-09-04 07:02:56 +01:00
rx	rx: re-randomize rng-seed on reboot	2022-10-27 11:34:31 +01:00
s390x	s390x: Fix spelling errors	2022-11-16 10:15:26 +01:00
scsi	hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)	2023-05-28 12:02:26 +03:00
sd	hw/sd/allwinner-sdhost: Correctly byteswap descriptor fields	2023-05-18 21:09:59 +03:00
sensor	hw/sensor: Add Renesas ISL69259 device model	2022-07-14 16:24:38 +02:00
sh4	Use g_new() & friends where that makes obvious sense	2022-03-21 15:44:44 +01:00
smbios	hw/smbios: fix field corruption in type 4 table	2023-03-29 10:20:04 +03:00
sparc	machine: make memory-backend a link property	2022-05-12 12:29:44 +02:00
sparc64	hw: Remove unused MAX_IDE_BUS define	2022-10-31 11:32:07 +01:00
ssi	aspeed/smc: Cache AspeedSMCClass	2022-10-24 11:20:15 +02:00
timer	hw/timer/nrf51_timer: Don't lose time when timer is queried in tight loop	2023-06-22 10:38:38 +03:00
tpm	tpm_crb: Avoid backend startup just before shutdown under Xen	2022-09-09 17:55:59 -04:00
tricore
usb	usb/ohci: Set pad to 0 after frame update	2023-05-28 12:02:26 +03:00
vfio	pci,pc,virtio: features, tests, fixes, cleanups	2022-11-07 18:43:56 -05:00
virtio	vhost: release memory_listener object in error path	2023-06-26 19:35:39 +03:00
watchdog	watchdog: remove -watchdog option	2022-09-29 11:40:28 +02:00
xen	xen/pt: reserve PCI slot 2 for Intel igd-passthru	2023-05-18 21:09:59 +03:00
xenpv	Warn user if the vga flag is passed but no vga device is created	2022-05-09 08:21:14 +02:00
xtensa	hw/xtensa: fix reset value of MIROUT register of MX PIC	2022-05-06 15:27:40 -07:00
Kconfig	hw/loongarch: Add support loongson3 virt machine type.	2022-06-06 18:09:03 +00:00
meson.build	hw/loongarch: Add support loongson3 virt machine type.	2022-06-06 18:09:03 +00:00