From patchwork Mon Apr 25 15:18:43 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cornelia Huck X-Patchwork-Id: 8929641 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 83DF1BF29F for ; Mon, 25 Apr 2016 15:20:04 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id DB5FF20123 for ; Mon, 25 Apr 2016 15:20:03 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 217DC201C7 for ; Mon, 25 Apr 2016 15:20:03 +0000 (UTC) Received: from localhost ([::1]:60645 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1auiIs-00023q-Be for patchwork-qemu-devel@patchwork.kernel.org; Mon, 25 Apr 2016 11:20:02 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48476) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1auiHx-0000Xz-Sh for qemu-devel@nongnu.org; Mon, 25 Apr 2016 11:19:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1auiHt-0006Vw-S5 for qemu-devel@nongnu.org; Mon, 25 Apr 2016 11:19:05 -0400 Received: from e06smtp15.uk.ibm.com ([195.75.94.111]:57351) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1auiHt-0006VC-Ik for qemu-devel@nongnu.org; Mon, 25 Apr 2016 11:19:01 -0400 Received: from localhost by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 25 Apr 2016 16:19:00 +0100 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 25 Apr 2016 16:18:58 +0100 X-IBM-Helo: d06dlp03.portsmouth.uk.ibm.com X-IBM-MailFrom: cornelia.huck@de.ibm.com X-IBM-RcptTo: qemu-devel@nongnu.org Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id DBBD41B0805F for ; Mon, 25 Apr 2016 16:19:43 +0100 (BST) Received: from d06av03.portsmouth.uk.ibm.com (d06av03.portsmouth.uk.ibm.com [9.149.37.213]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u3PFIvoJ62849164 for ; Mon, 25 Apr 2016 15:18:57 GMT Received: from d06av03.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u3PFItQo010163 for ; Mon, 25 Apr 2016 09:18:56 -0600 Received: from gondolin.boeblingen.de.ibm.com (dyn-9-152-224-197.boeblingen.de.ibm.com [9.152.224.197]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id u3PFIo1q009910 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 25 Apr 2016 09:18:55 -0600 From: Cornelia Huck To: qemu-devel@nongnu.org Date: Mon, 25 Apr 2016 17:18:43 +0200 Message-Id: <1461597528-9760-5-git-send-email-cornelia.huck@de.ibm.com> X-Mailer: git-send-email 2.8.1 In-Reply-To: <1461597528-9760-1-git-send-email-cornelia.huck@de.ibm.com> References: <1461597528-9760-1-git-send-email-cornelia.huck@de.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16042515-0021-0000-0000-000033FE1C69 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.75.94.111 Subject: [Qemu-devel] [PATCH for-2.7 4/9] s390x/ipl: Add type and length checks for IplParameterBlock values X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Cornelia Huck , borntraeger@de.ibm.com, jfrei@linux.vnet.ibm.com, agraf@suse.de, Alexander Yarygin Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Alexander Yarygin We can check for valid type and lengths of the IplParameterBlock fields when receiving the struct from the guest. Length of the IplParameterBlock can be less than 4K. To play safe we can read and write only required amount of data. Signed-off-by: Alexander Yarygin Reviewed-by: David Hildenband Acked-by: Christian Borntraeger Signed-off-by: Cornelia Huck --- hw/s390x/ipl.h | 21 +++++++++++++++++++++ target-s390x/misc_helper.c | 17 +++++++++++++++-- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 271a8ca..e3c208a 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -99,6 +99,27 @@ struct S390IPLState { }; typedef struct S390IPLState S390IPLState; +#define S390_IPL_TYPE_FCP 0x00 +#define S390_IPL_TYPE_CCW 0x02 + #define S390_IPLB_MIN_CCW_LEN 200 +#define S390_IPLB_MIN_FCP_LEN 384 + +static inline bool iplb_valid_len(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock); +} + +static inline bool iplb_valid_ccw(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN && + iplb->pbt == S390_IPL_TYPE_CCW; +} + +static inline bool iplb_valid_fcp(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN && + iplb->pbt == S390_IPL_TYPE_FCP; +} #endif diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c index fab7f87..462cfc8 100644 --- a/target-s390x/misc_helper.c +++ b/target-s390x/misc_helper.c @@ -233,9 +233,22 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3) return; } iplb = g_malloc0(sizeof(IplParameterBlock)); - cpu_physical_memory_read(addr, iplb, S390_IPLB_MIN_CCW_LEN); + cpu_physical_memory_read(addr, iplb, sizeof(iplb->len)); + if (!iplb_valid_len(iplb)) { + env->regs[r1 + 1] = DIAG_308_RC_INVALID; + goto out; + } + + cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len)); + + if (!iplb_valid_ccw(iplb) && !iplb_valid_fcp(iplb)) { + env->regs[r1 + 1] = DIAG_308_RC_INVALID; + goto out; + } + s390_ipl_update_diag308(iplb); env->regs[r1 + 1] = DIAG_308_RC_OK; +out: g_free(iplb); return; case 6: @@ -250,7 +263,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3) } iplb = s390_ipl_get_iplb(); if (iplb) { - cpu_physical_memory_write(addr, iplb, S390_IPLB_MIN_CCW_LEN); + cpu_physical_memory_write(addr, iplb, be32_to_cpu(iplb->len)); env->regs[r1 + 1] = DIAG_308_RC_OK; } else { env->regs[r1 + 1] = DIAG_308_RC_NO_CONF;