From nobody Sat May 4 12:23:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1579187490; cv=none; d=zohomail.com; s=zohoarc; b=RWlA1HdU8bHvfekzW86spIrQ6wXb3YaYnCTyOucnaoCzb4/zVLVJusiiUigbQZoPhob9rYfLXnuNrMMfDk72KlCpe92tii4nKXqX5/63fjKpaKjbL3DMFHgONdJei8dkszNU7+NxycrAiPO74QNO9Rpj4539bC1Uhp6g+uSxtdM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1579187490; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=0FT980AcfA39THi59Q455PsD8+eTGqkDRU8Xj3D5Cug=; b=Xd/BNkrTo5+7WI55yANwLD0M7eggzq6xbINm8w/rM2/MEWFKerrv4ineLADgvYwfH8E7g32uOTsJaZ3OHDX2EJhdoBf39UxfGSQRsXg3IO5sZx+YgEcaG0+R2CnezDo/z+9W9CnRVETbOeGaSBS+e1N4+GbLQ83wgCph242YYP8= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1579187490655183.6464155370677; Thu, 16 Jan 2020 07:11:30 -0800 (PST) Received: from localhost ([::1]:43678 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1is6nx-0003bO-J1 for importer@patchew.org; Thu, 16 Jan 2020 10:11:29 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:59235) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1is6mN-00016F-Jo for qemu-devel@nongnu.org; Thu, 16 Jan 2020 10:09:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1is6mM-0007pz-Dq for qemu-devel@nongnu.org; Thu, 16 Jan 2020 10:09:51 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:35026 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1is6mM-0007p9-9m for qemu-devel@nongnu.org; Thu, 16 Jan 2020 10:09:50 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 00GF9hFM088839 for ; Thu, 16 Jan 2020 10:09:49 -0500 Received: from e06smtp01.uk.ibm.com (e06smtp01.uk.ibm.com [195.75.94.97]) by mx0b-001b2d01.pphosted.com with ESMTP id 2xhbptajx9-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 16 Jan 2020 10:09:45 -0500 Received: from localhost by e06smtp01.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 16 Jan 2020 15:06:05 -0000 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp01.uk.ibm.com (192.168.101.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Thu, 16 Jan 2020 15:05:58 -0000 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 00GF5v1Q55509098 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 16 Jan 2020 15:05:57 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1E41311C0A7; Thu, 16 Jan 2020 15:05:57 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F1AA111C088; Thu, 16 Jan 2020 15:05:56 +0000 (GMT) Received: from bahia.lan (unknown [9.145.1.176]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 16 Jan 2020 15:05:56 +0000 (GMT) Subject: [PATCH] spapr: Fail CAS if option vector table cannot be parsed From: Greg Kurz To: David Gibson Date: Thu, 16 Jan 2020 16:05:56 +0100 User-Agent: StGit/unknown-version MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 x-cbid: 20011615-4275-0000-0000-000003982212 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20011615-4276-0000-0000-000038AC2154 Message-Id: <157918715618.376249.7891210201270364781.stgit@bahia.lan> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.572 definitions=2020-01-16_04:2020-01-16, 2020-01-15 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 impostorscore=0 bulkscore=0 clxscore=1034 lowpriorityscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 adultscore=0 spamscore=0 mlxscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1910280000 definitions=main-2001160126 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-ppc@nongnu.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Most of the option vector helpers have assertions to check their arguments aren't null. The guest can provide an arbitrary address for the CAS structure that would result in such null arguments. Fail CAS with H_PARAMETER instead of aborting QEMU. Signed-off-by: Greg Kurz Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/ppc/spapr_hcall.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c index 84e1612595bb..051869ae20ec 100644 --- a/hw/ppc/spapr_hcall.c +++ b/hw/ppc/spapr_hcall.c @@ -1701,9 +1701,18 @@ static target_ulong h_client_architecture_support(Po= werPCCPU *cpu, =20 /* For the future use: here @ov_table points to the first option vecto= r */ ov_table =3D addr; + if (!ov_table) { + return H_PARAMETER; + } =20 ov1_guest =3D spapr_ovec_parse_vector(ov_table, 1); + if (!ov1_guest) { + return H_PARAMETER; + } ov5_guest =3D spapr_ovec_parse_vector(ov_table, 5); + if (!ov5_guest) { + return H_PARAMETER; + } if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) { error_report("guest requested hash and radix MMU, which is invalid= ."); exit(EXIT_FAILURE);