From nobody Fri May 3 18:29:18 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1579252630; cv=none; d=zohomail.com; s=zohoarc; b=dERbV9MDUrcMzHLdERrUMLLkGq/X2iioKG/xCKFfWiqtcH7+hTr/pUDY6l6aFPt81q2g26Y8udiY2Lr0hdxiqmjPWPHimRGQCj4hsreQ/Ye1z35bAWf1pSfXc2tTKYkU2bj1uLDrMDHEdF9JPUMzMKc59Z8i/48OECA43eK7vNI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1579252630; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=hyG9zZs2XUGGgmMAVwYEjDMK9GCb2lGjbwmmxUCMmBw=; b=RVf3IZElm+XqOWLHzvMNc8+y5A+VuIIZDPYGN3ckg9DOFy7ZaQOwLBldztfZHpw8khmbq92JpP5ZeoLMe4T1d1j3Eu9whl+SJZl0cHjvOe/ZyL8oTD17pN7YgdfI8KwAMsX+KfSMmxgmpCdFOZDf+Kp1Q0xpo69cKkmO4gALgRU= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1579252630549112.91512398415728; Fri, 17 Jan 2020 01:17:10 -0800 (PST) Received: from localhost ([::1]:54322 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1isNkb-0006YW-61 for importer@patchew.org; Fri, 17 Jan 2020 04:17:09 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:47142) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1isNjW-00061w-AY for qemu-devel@nongnu.org; Fri, 17 Jan 2020 04:16:03 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1isNjV-0006A3-9e for qemu-devel@nongnu.org; Fri, 17 Jan 2020 04:16:02 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:61461 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1isNjV-000696-5n for qemu-devel@nongnu.org; Fri, 17 Jan 2020 04:16:01 -0500 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 00H9D8lt124580 for ; Fri, 17 Jan 2020 04:15:59 -0500 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0b-001b2d01.pphosted.com with ESMTP id 2xk0qsnxgs-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 17 Jan 2020 04:15:59 -0500 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 17 Jan 2020 09:15:58 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (9.149.109.194) by e06smtp04.uk.ibm.com (192.168.101.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 17 Jan 2020 09:15:54 -0000 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 00H9Frtr59179160 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 17 Jan 2020 09:15:53 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7BE0911C050; Fri, 17 Jan 2020 09:15:53 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4A2B511C052; Fri, 17 Jan 2020 09:15:53 +0000 (GMT) Received: from bahia.lan (unknown [9.145.1.176]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 17 Jan 2020 09:15:53 +0000 (GMT) Subject: [PATCH v3] spapr: Fail CAS if option vector table cannot be parsed From: Greg Kurz To: David Gibson Date: Fri, 17 Jan 2020 10:15:52 +0100 User-Agent: StGit/unknown-version MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-TM-AS-GCONF: 00 x-cbid: 20011709-0016-0000-0000-000002DE30C9 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20011709-0017-0000-0000-00003340CBEB Message-Id: <157925255250.397143.10855183619366882459.stgit@bahia.lan> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.572 definitions=2020-01-17_02:2020-01-16, 2020-01-17 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 bulkscore=0 spamscore=0 clxscore=1034 malwarescore=0 suspectscore=0 lowpriorityscore=0 mlxlogscore=999 phishscore=0 priorityscore=1501 impostorscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1910280000 definitions=main-2001170072 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mx0b-001b2d01.pphosted.com id 00H9D8lt124580 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Philippe =?utf-8?q?Mathieu-Daud=C3=A9?= , qemu-ppc@nongnu.org, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Most of the option vector helpers have assertions to check their arguments aren't null. The guest can provide an arbitrary address for the CAS structure that would result in such null arguments. Fail CAS with H_PARAMETER and print a warning instead of aborting QEMU. Signed-off-by: Greg Kurz Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- v3: - drop ov_table check v2: - print warnings --- hw/ppc/spapr_hcall.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c index f1799b1b707d..ffb14641f9d3 100644 --- a/hw/ppc/spapr_hcall.c +++ b/hw/ppc/spapr_hcall.c @@ -1703,7 +1703,15 @@ static target_ulong h_client_architecture_support(Po= werPCCPU *cpu, ov_table =3D addr; =20 ov1_guest =3D spapr_ovec_parse_vector(ov_table, 1); + if (!ov1_guest) { + warn_report("guest didn't provide option vector 1"); + return H_PARAMETER; + } ov5_guest =3D spapr_ovec_parse_vector(ov_table, 5); + if (!ov5_guest) { + warn_report("guest didn't provide option vector 5"); + return H_PARAMETER; + } if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) { error_report("guest requested hash and radix MMU, which is invalid= ."); exit(EXIT_FAILURE);