[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 05/34] spapr: sanity check size of the CAS buffer
From: |
David Gibson |
Subject: |
[Qemu-devel] [PULL 05/34] spapr: sanity check size of the CAS buffer |
Date: |
Tue, 17 Oct 2017 15:21:23 +1100 |
From: Greg Kurz <address@hidden>
The CAS buffer is provided by SLOF. A broken SLOF could pass a silly
size: either smaller than the diff header, in which case the current
code will try to allocate 16 Exabytes of memory and g_malloc0() will
abort, or bigger than the maximum memory provisioned for SLOF (ie,
40 Megabytes), which doesn't make sense. Both cases indicate that
SLOF has a bug.
Let's print out an explicit error message and exit since rebooting as
we do with other errors would only result in a reset loop.
Signed-off-by: Greg Kurz <address@hidden>
[dwg: Fix format specifier that broke 32-bit builds]
Signed-off-by: David Gibson <address@hidden>
---
hw/ppc/spapr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index b284e0b9d4..079e493ef4 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -819,6 +819,13 @@ int spapr_h_cas_compose_response(sPAPRMachineState *spapr,
return 1;
}
+ if (size < sizeof(hdr) || size > FW_MAX_SIZE) {
+ error_report("SLOF provided an unexpected CAS buffer size "
+ TARGET_FMT_lu " (min: %zu, max: %u)",
+ size, sizeof(hdr), FW_MAX_SIZE);
+ exit(EXIT_FAILURE);
+ }
+
size -= sizeof(hdr);
/* Create skeleton */
--
2.13.6
- [Qemu-devel] [PULL 00/34] ppc-for-2.11 queue 20171017, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 02/34] hw/ppc: use 0 instead of fdt_path_offset(fdt, "/"), David Gibson, 2017/10/17
- [Qemu-devel] [PULL 01/34] macio: add missing registers to VMStateDescription, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 03/34] target/ppc: Remove unused PPC 460 and 460F definitions, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 04/34] spapr: fix OF word name in comment, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 05/34] spapr: sanity check size of the CAS buffer,
David Gibson <=
- [Qemu-devel] [PULL 14/34] ppc: bamboo: use generic cpu_model parsing, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 12/34] ppc: mac_newworld: use generic cpu_model parsing, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 13/34] ppc: mac_oldworld: use generic cpu_model parsing, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 11/34] ppc: mpc8544ds/e500plat: use generic cpu_model parsing, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 16/34] ppc: virtex-ml507: replace cpu_model with cpu_type, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 09/34] qom: introduce type_register_static_array(), David Gibson, 2017/10/17
- [Qemu-devel] [PULL 22/34] ppc: spapr: register 'host' core type along with the rest of core types, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 24/34] ppc: move ppc_cpu_lookup_alias() before its first user, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 07/34] target/ppc: Fix carry flag setting for shift algebraic instructions, David Gibson, 2017/10/17
- [Qemu-devel] [PULL 10/34] qom: add helper macro DEFINE_TYPES(), David Gibson, 2017/10/17