[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 for-2.7 04/20] s390x/ipl: Add type and length che
From: |
Cornelia Huck |
Subject: |
[Qemu-devel] [PATCH v2 for-2.7 04/20] s390x/ipl: Add type and length checks for IplParameterBlock values |
Date: |
Wed, 11 May 2016 16:57:56 +0200 |
From: Alexander Yarygin <address@hidden>
We can check for valid type and lengths of the IplParameterBlock fields
when receiving the struct from the guest.
Length of the IplParameterBlock can be less than 4K. To play safe we can
read and write only required amount of data.
Signed-off-by: Alexander Yarygin <address@hidden>
Reviewed-by: David Hildenband <address@hidden>
Acked-by: Christian Borntraeger <address@hidden>
Signed-off-by: Cornelia Huck <address@hidden>
---
hw/s390x/ipl.h | 21 +++++++++++++++++++++
target-s390x/misc_helper.c | 17 +++++++++++++++--
2 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
index 73b86e3..08f1d5c 100644
--- a/hw/s390x/ipl.h
+++ b/hw/s390x/ipl.h
@@ -99,6 +99,27 @@ struct S390IPLState {
};
typedef struct S390IPLState S390IPLState;
+#define S390_IPL_TYPE_FCP 0x00
+#define S390_IPL_TYPE_CCW 0x02
+
#define S390_IPLB_MIN_CCW_LEN 200
+#define S390_IPLB_MIN_FCP_LEN 384
+
+static inline bool iplb_valid_len(IplParameterBlock *iplb)
+{
+ return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock);
+}
+
+static inline bool iplb_valid_ccw(IplParameterBlock *iplb)
+{
+ return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN &&
+ iplb->pbt == S390_IPL_TYPE_CCW;
+}
+
+static inline bool iplb_valid_fcp(IplParameterBlock *iplb)
+{
+ return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN &&
+ iplb->pbt == S390_IPL_TYPE_FCP;
+}
#endif
diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c
index fab7f87..462cfc8 100644
--- a/target-s390x/misc_helper.c
+++ b/target-s390x/misc_helper.c
@@ -233,9 +233,22 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1,
uint64_t r3)
return;
}
iplb = g_malloc0(sizeof(IplParameterBlock));
- cpu_physical_memory_read(addr, iplb, S390_IPLB_MIN_CCW_LEN);
+ cpu_physical_memory_read(addr, iplb, sizeof(iplb->len));
+ if (!iplb_valid_len(iplb)) {
+ env->regs[r1 + 1] = DIAG_308_RC_INVALID;
+ goto out;
+ }
+
+ cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len));
+
+ if (!iplb_valid_ccw(iplb) && !iplb_valid_fcp(iplb)) {
+ env->regs[r1 + 1] = DIAG_308_RC_INVALID;
+ goto out;
+ }
+
s390_ipl_update_diag308(iplb);
env->regs[r1 + 1] = DIAG_308_RC_OK;
+out:
g_free(iplb);
return;
case 6:
@@ -250,7 +263,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1,
uint64_t r3)
}
iplb = s390_ipl_get_iplb();
if (iplb) {
- cpu_physical_memory_write(addr, iplb, S390_IPLB_MIN_CCW_LEN);
+ cpu_physical_memory_write(addr, iplb, be32_to_cpu(iplb->len));
env->regs[r1 + 1] = DIAG_308_RC_OK;
} else {
env->regs[r1 + 1] = DIAG_308_RC_NO_CONF;
--
2.6.6
- [Qemu-devel] [PATCH v2 for-2.7 00/20] First batch of s390x patches, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 02/20] s390x: enable runtime instrumentation, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 07/20] pc-bios/s390-ccw: Get device address via diag 308/6, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 05/20] s390x/ipl: Provide ipl parameter block, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 01/20] s390x: add compat machine for 2.7, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 12/20] s390x/pci: fix reg_irqs(), Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 18/20] s390x/pci: enhance mpcifc_service_call, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 04/20] s390x/ipl: Add type and length checks for IplParameterBlock values,
Cornelia Huck <=
- [Qemu-devel] [PATCH v2 for-2.7 16/20] s390x/pci: introduce S390PCIBusDevice.iommu_enabled, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 13/20] s390x/pci: separate s390_sclp_configure function, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 15/20] s390x/pci: export pci_dereg_ioat and pci_dereg_irqs, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 03/20] s390x/ipl: Extend the IplParameterBlock struct, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 06/20] s390x/ipl: Add ssid field to IplParameterBlock, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 11/20] hw/char: QOM'ify sclpconsole.c, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 20/20] s390x/pci: remove whitespace, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 17/20] s390x/pci: fix s390_pci_sclp_deconfigure, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 14/20] s390x/pci: separate s390_pcihost_iommu_configure function, Cornelia Huck, 2016/05/11
- [Qemu-devel] [PATCH v2 for-2.7 10/20] hw/char: QOM'ify sclpconsole-lm.c, Cornelia Huck, 2016/05/11