From patchwork Mon Feb 3 06:10:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 11362073 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D3484138D for ; Mon, 3 Feb 2020 06:14:52 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A88642080D for ; Mon, 3 Feb 2020 06:14:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.b="gkRz04Q3" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A88642080D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Received: from localhost ([::1]:34772 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iyV0V-0007uq-Nu for patchwork-qemu-devel@patchwork.kernel.org; Mon, 03 Feb 2020 01:14:51 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:57133) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iyUxL-0002LX-UV for qemu-devel@nongnu.org; Mon, 03 Feb 2020 01:11:37 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iyUxK-0002W5-UF for qemu-devel@nongnu.org; Mon, 03 Feb 2020 01:11:35 -0500 Received: from bilbo.ozlabs.org ([2401:3900:2:1::2]:33803 helo=ozlabs.org) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1iyUxK-0002Tt-Jg; Mon, 03 Feb 2020 01:11:34 -0500 Received: by ozlabs.org (Postfix, from userid 1007) id 489yBm4bMpz9sSD; Mon, 3 Feb 2020 17:11:28 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1580710288; bh=PVwxscjrI7jhsuwlQkAC7qDnh7+BHJbvc7CrDJ8cLlc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gkRz04Q3e2RRTz6JGFaK2GtPf2sfvTYxAmzwgPGaKhkSjzUNql9s0bASRaPtwZs2A RYtQ5Ox92CyhEnPDBa+5sfNDZolGSDbFl5dvp8V6l2v9HjXBWWUMxHOM/XjnEEWiOb mzinrI+y2321k0H0eoOFPGNpxvtysgEF7+rLBIIs= From: David Gibson To: peter.maydell@linaro.org Subject: [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed Date: Mon, 3 Feb 2020 17:10:54 +1100 Message-Id: <20200203061123.59150-7-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203061123.59150-1-david@gibson.dropbear.id.au> References: <20200203061123.59150-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2401:3900:2:1::2 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lvivier@redhat.com, qemu-devel@nongnu.org, groug@kaod.org, qemu-ppc@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , David Gibson Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" From: Greg Kurz Most of the option vector helpers have assertions to check their arguments aren't null. The guest can provide an arbitrary address for the CAS structure that would result in such null arguments. Fail CAS with H_PARAMETER and print a warning instead of aborting QEMU. Signed-off-by: Greg Kurz Reviewed-by: Philippe Mathieu-Daudé Message-Id: <157925255250.397143.10855183619366882459.stgit@bahia.lan> Signed-off-by: David Gibson --- hw/ppc/spapr_hcall.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c index f1799b1b70..ffb14641f9 100644 --- a/hw/ppc/spapr_hcall.c +++ b/hw/ppc/spapr_hcall.c @@ -1703,7 +1703,15 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu, ov_table = addr; ov1_guest = spapr_ovec_parse_vector(ov_table, 1); + if (!ov1_guest) { + warn_report("guest didn't provide option vector 1"); + return H_PARAMETER; + } ov5_guest = spapr_ovec_parse_vector(ov_table, 5); + if (!ov5_guest) { + warn_report("guest didn't provide option vector 5"); + return H_PARAMETER; + } if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) { error_report("guest requested hash and radix MMU, which is invalid."); exit(EXIT_FAILURE);