1. Patchew
  2. QEMU
  3. View series

[Qemu-devel] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images

Thomas Huth posted 1 patch 5 years, 10 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/1528738007-29122-1-git-send-email-thuth@redhat.com
Test checkpatch passed
Test docker-mingw@fedora passed
Test docker-quick@centos7 passed
Test s390x passed
hw/s390x/ipl.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
[Qemu-devel] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Thomas Huth 5 years, 10 months ago 
Add a sanity checks to fix the following two crashes:

$ echo "Insane in the mainframe" > /tmp/test.txt
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
Segmentation fault (core dumped)
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
Segmentation fault (core dumped)

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 v2: Fixed 2nd crash with -initrd

 hw/s390x/ipl.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 04245b5..2ff8f20 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
          * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
          * loader) and it won't work. For this case we force it to 0x10000, too.
          */
-        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
+        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
+            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
             ipl->start_addr = KERN_IMAGE_START;
             /* Overwrite parameters in the kernel image, which are "rom" */
             strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
@@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
              * we have to overwrite values in the kernel image,
              * which are "rom"
              */
-            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
-            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
+            if (kernel_size > INITRD_PARM_SIZE + 8) {
+                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
+                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
+            }
         }
     }
     /*
-- 
1.8.3.1
Re: [Qemu-devel] [qemu-s390x] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Christian Borntraeger 5 years, 10 months ago 

On 06/11/2018 07:26 PM, Thomas Huth wrote:
> Add a sanity checks to fix the following two crashes:
> 
> $ echo "Insane in the mainframe" > /tmp/test.txt
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
> Segmentation fault (core dumped)
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
> Segmentation fault (core dumped)
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
> ---
>  v2: Fixed 2nd crash with -initrd
> 
>  hw/s390x/ipl.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index 04245b5..2ff8f20 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>           * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
>           * loader) and it won't work. For this case we force it to 0x10000, too.
>           */
> -        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
> +        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
> +            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
>              ipl->start_addr = KERN_IMAGE_START;
>              /* Overwrite parameters in the kernel image, which are "rom" */
>              strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
> @@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>               * we have to overwrite values in the kernel image,
>               * which are "rom"
>               */
> -            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> -            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> +            if (kernel_size > INITRD_PARM_SIZE + 8) {
> +                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> +                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> +            }
>          }
>      }
>      /*
>
Re: [Qemu-devel] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Cornelia Huck 5 years, 10 months ago 
On Mon, 11 Jun 2018 19:26:47 +0200
Thomas Huth <thuth@redhat.com> wrote:

I've tweaked $SUBJECT to

hw/s390x/ipl: Fix crashes when using -kernel/-initrd with small images

> Add a sanity checks to fix the following two crashes:

Also, s/Add a sanity checks/Add sanity checks/

> 
> $ echo "Insane in the mainframe" > /tmp/test.txt
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
> Segmentation fault (core dumped)
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
> Segmentation fault (core dumped)
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>  v2: Fixed 2nd crash with -initrd
> 
>  hw/s390x/ipl.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)

Thanks, applied.
Re: [Qemu-devel] [qemu-s390x] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Thomas Huth 5 years, 10 months ago 
On 11.06.2018 19:26, Thomas Huth wrote:
> Add a sanity checks to fix the following two crashes:
> 
> $ echo "Insane in the mainframe" > /tmp/test.txt
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
> Segmentation fault (core dumped)
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
> Segmentation fault (core dumped)
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>  v2: Fixed 2nd crash with -initrd
> 
>  hw/s390x/ipl.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index 04245b5..2ff8f20 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>           * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
>           * loader) and it won't work. For this case we force it to 0x10000, too.
>           */
> -        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
> +        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
> +            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
>              ipl->start_addr = KERN_IMAGE_START;
>              /* Overwrite parameters in the kernel image, which are "rom" */
>              strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
> @@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>               * we have to overwrite values in the kernel image,
>               * which are "rom"
>               */
> -            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> -            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> +            if (kernel_size > INITRD_PARM_SIZE + 8) {
> +                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> +                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> +            }
>          }
>      }
>      /*

I just had to discover that this breaks the argv handling in
kvm-unit-tests. Cornelia, could you please unqueue this patch again?
I'll try to come up with a better solution...

 Thomas
Re: [Qemu-devel] [qemu-s390x] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Cornelia Huck 5 years, 10 months ago 
On Thu, 14 Jun 2018 21:08:43 +0200
Thomas Huth <thuth@redhat.com> wrote:

> On 11.06.2018 19:26, Thomas Huth wrote:
> > Add a sanity checks to fix the following two crashes:
> > 
> > $ echo "Insane in the mainframe" > /tmp/test.txt
> > $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
> > Segmentation fault (core dumped)
> > $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
> > Segmentation fault (core dumped)
> > 
> > Signed-off-by: Thomas Huth <thuth@redhat.com>
> > ---
> >  v2: Fixed 2nd crash with -initrd
> > 
> >  hw/s390x/ipl.c | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> > 
> > diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> > index 04245b5..2ff8f20 100644
> > --- a/hw/s390x/ipl.c
> > +++ b/hw/s390x/ipl.c
> > @@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
> >           * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
> >           * loader) and it won't work. For this case we force it to 0x10000, too.
> >           */
> > -        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
> > +        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
> > +            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
> >              ipl->start_addr = KERN_IMAGE_START;
> >              /* Overwrite parameters in the kernel image, which are "rom" */
> >              strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
> > @@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
> >               * we have to overwrite values in the kernel image,
> >               * which are "rom"
> >               */
> > -            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> > -            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> > +            if (kernel_size > INITRD_PARM_SIZE + 8) {
> > +                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
> > +                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
> > +            }
> >          }
> >      }
> >      /*  
> 
> I just had to discover that this breaks the argv handling in
> kvm-unit-tests. Cornelia, could you please unqueue this patch again?
> I'll try to come up with a better solution...

Argh. I wonder why?

Unqueued.
Re: [Qemu-devel] [qemu-s390x] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images
Posted by Thomas Huth 5 years, 10 months ago 
On 15.06.2018 09:13, Cornelia Huck wrote:
> On Thu, 14 Jun 2018 21:08:43 +0200
> Thomas Huth <thuth@redhat.com> wrote:
> 
>> On 11.06.2018 19:26, Thomas Huth wrote:
>>> Add a sanity checks to fix the following two crashes:
>>>
>>> $ echo "Insane in the mainframe" > /tmp/test.txt
>>> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
>>> Segmentation fault (core dumped)
>>> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
>>> Segmentation fault (core dumped)
>>>
>>> Signed-off-by: Thomas Huth <thuth@redhat.com>
>>> ---
>>>  v2: Fixed 2nd crash with -initrd
>>>
>>>  hw/s390x/ipl.c | 9 ++++++---
>>>  1 file changed, 6 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
>>> index 04245b5..2ff8f20 100644
>>> --- a/hw/s390x/ipl.c
>>> +++ b/hw/s390x/ipl.c
>>> @@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>>>           * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
>>>           * loader) and it won't work. For this case we force it to 0x10000, too.
>>>           */
>>> -        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
>>> +        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
>>> +            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
>>>              ipl->start_addr = KERN_IMAGE_START;
>>>              /* Overwrite parameters in the kernel image, which are "rom" */
>>>              strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
>>> @@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>>>               * we have to overwrite values in the kernel image,
>>>               * which are "rom"
>>>               */
>>> -            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
>>> -            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
>>> +            if (kernel_size > INITRD_PARM_SIZE + 8) {
>>> +                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
>>> +                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
>>> +            }
>>>          }
>>>      }
>>>      /*  
>>
>> I just had to discover that this breaks the argv handling in
>> kvm-unit-tests. Cornelia, could you please unqueue this patch again?
>> I'll try to come up with a better solution...
> 
> Argh. I wonder why?

kvm-unit-tests are ELF files which are not loaded to address 0, but
still use the same entry point as Linux (0x10000) to be able to use the
"--append" option of QEMU. Thus the check "kernel_size > KERN_PARM_AREA
+ strlen(ipl->cmdline)" does not work here. We'd need something like
"start_addr + kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)"
instead - but this does not make too much sense with ELF files that have
multiple segments either.

The correct fix is to check the size when calling rom_ptr() instead. I
just sent a patch that does this.

 Thomas

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.