37d2bcbc2a
The expiration time provided for timer_mod() can overflow if a
ridiculously large value is set to the comparator register. The
resulting value can represent a past time after rounded, forcing the
timer to fire immediately. If the timer is configured as periodic, it
will rearm the timer again, and form an endless loop.
Check if the expiration value will overflow, and if it will, stop the
timer instead of rearming the timer with the overflowed time.
This bug was found by Alexander Bulekov when fuzzing igb, a new
network device emulation:
https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/
The fixed test case is:
fuzz/crash_2d7036941dcda1ad4380bb8a9174ed0c949bcefd
Fixes:
|
||
|---|---|---|
| .. | ||
| a9gtimer.c | ||
| allwinner-a10-pit.c | ||
| altera_timer.c | ||
| arm_mptimer.c | ||
| arm_timer.c | ||
| armv7m_systick.c | ||
| aspeed_timer.c | ||
| avr_timer16.c | ||
| bcm2835_systmr.c | ||
| cadence_ttc.c | ||
| cmsdk-apb-dualtimer.c | ||
| cmsdk-apb-timer.c | ||
| digic-timer.c | ||
| etraxfs_timer.c | ||
| exynos4210_mct.c | ||
| exynos4210_pwm.c | ||
| grlib_gptimer.c | ||
| hpet.c | ||
| i8254_common.c | ||
| i8254.c | ||
| ibex_timer.c | ||
| imx_epit.c | ||
| imx_gpt.c | ||
| Kconfig | ||
| meson.build | ||
| mips_gictimer.c | ||
| mss-timer.c | ||
| npcm7xx_timer.c | ||
| nrf51_timer.c | ||
| omap_gptimer.c | ||
| omap_synctimer.c | ||
| pxa2xx_timer.c | ||
| renesas_cmt.c | ||
| renesas_tmr.c | ||
| sh_timer.c | ||
| sifive_pwm.c | ||
| slavio_timer.c | ||
| sse-counter.c | ||
| sse-timer.c | ||
| stellaris-gptm.c | ||
| stm32f2xx_timer.c | ||
| trace-events | ||
| trace.h | ||
| xilinx_timer.c | ||