From patchwork Wed Nov 21 05:10:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Li Qiang X-Patchwork-Id: 10691939 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EE36614BD for ; Wed, 21 Nov 2018 05:12:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D22392B6E3 for ; Wed, 21 Nov 2018 05:12:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C61CC2B6E6; Wed, 21 Nov 2018 05:12:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6CF862B6EB for ; Wed, 21 Nov 2018 05:12:00 +0000 (UTC) Received: from localhost ([::1]:37251 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gPKnv-0004ny-M1 for patchwork-qemu-devel@patchwork.kernel.org; Wed, 21 Nov 2018 00:11:59 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43714) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gPKmg-0003yG-6x for qemu-devel@nongnu.org; Wed, 21 Nov 2018 00:10:42 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gPKmf-0002wc-ER for qemu-devel@nongnu.org; Wed, 21 Nov 2018 00:10:42 -0500 Received: from mail-pl1-x644.google.com ([2607:f8b0:4864:20::644]:41375) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gPKmf-0002vf-8d for qemu-devel@nongnu.org; Wed, 21 Nov 2018 00:10:41 -0500 Received: by mail-pl1-x644.google.com with SMTP id u6so3686176plm.8 for ; Tue, 20 Nov 2018 21:10:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=0zb5N5AbqXddbzmg7qR+gXe/f6u/EHZ8/2vSauq5I6Q=; b=e90HWB0Ats89t9NGXdVrj1NTMP9iJ0oSbXFydpVruzRy+HEmaYNELvW7rApzYmL6P2 xCczP6Ed3YNUiW/MPZNTKCvv78qJ8psOcYBPSzC75+WsDB1odCtXZwH0wqTlKenxeiqK ATPzM5gHlTr1ZcfojH+1Ocer4QkBrk8NELmnWfCU68KATFWTTsJbap6GlB/eUav/U4Sm xeIFYqJ/Z818dThVjclYpl+iQfsdxB8aiSonq+EFAmCZ+4XZXkYqOHAvMhhml7kWxCCa 3Qe+WwoLNtkF/6zkRei6uT6C5YDovHmDmHWovtFrNcWTZeYXlbnYDbAVdB3RlmBIy8nE oEiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=0zb5N5AbqXddbzmg7qR+gXe/f6u/EHZ8/2vSauq5I6Q=; b=HYSt8t8TlFveqA9jvk2EdEHoCiKf/AAZTVvdqwz+F2UVM6SJ7ybKFhdTFamOAoBxP9 WgHn4krHxd0rC3NmSFs0tZI+N625CtJ0HjVgoEfgYKqfZ4SmPY0vfnB6rVxXRztMYHzf xhIT0JgKUUwNKUkDy4/MtjFTOC3IjmCh2FhHexcg9FnLwd6C/P9ZOz0DXEvplPDTE/gN WN+ze8X1yqMpEFRewCCnsGa+68O176tYTDClYMIcTVSdywSKUb5PTIDAEWHPJYTHOEyo UPS6ZuhG9V5O3npI5sgh7rTDkXh4wshYyRUfmTduw3CC4GrKosdRELDq0hOFd1ZiSsJr cTsg== X-Gm-Message-State: AA+aEWaBypWrCwsWUZCweLey3tEXoDudrn0TDbZdqYjodYkdnMt/RmAe qlA7ovYF2kZ346g/+PUK9Vk= X-Google-Smtp-Source: AFSGD/VUAPQ9Rny/Z6p9nwcqyRHKGkpPO2GSDBSmjsS3E4RutzYoHmrhhSaXQe35qAfSJa2XOPJ4OQ== X-Received: by 2002:a17:902:7848:: with SMTP id e8mr5423892pln.100.1542777040462; Tue, 20 Nov 2018 21:10:40 -0800 (PST) Received: from localhost.localdomain.localdomain ([103.129.255.252]) by smtp.gmail.com with ESMTPSA id b62-v6sm52846616pfa.159.2018.11.20.21.10.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Nov 2018 21:10:40 -0800 (PST) From: Li Qiang To: armbru@redhat.com, pbonzini@redhat.com, kraxel@redhat.com, lersek@redhat.com, philmd@redhat.com Date: Tue, 20 Nov 2018 21:10:25 -0800 Message-Id: <1542777026-2788-3-git-send-email-liq3ea@gmail.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1542777026-2788-1-git-send-email-liq3ea@gmail.com> References: <1542777026-2788-1-git-send-email-liq3ea@gmail.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::644 Subject: [Qemu-devel] [PATCH v2 2/3] fw_cfg: fix -boot reboot-timeout error checking X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: liq3ea@gmail.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP fw_cfg_reboot() gets option parameter "reboot-timeout" with qemu_opt_get(), then converts it to an integer by hand. It neglects to check that conversion for errors, and fails to reject negative values. Positive values above the limit get reported and replaced by the limit. This patch checks for conversion errors properly, and reject all values outside 0...0xffff. Signed-off-by: Li Qiang Reviewed-by: Markus Armbruster Reviewed-by: Philippe Mathieu-Daudé --- v1->v2: commit typo fix hw/nvram/fw_cfg.c | 27 +++++++++++++-------------- vl.c | 2 +- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c index 83d66818f6..aafa96721f 100644 --- a/hw/nvram/fw_cfg.c +++ b/hw/nvram/fw_cfg.c @@ -177,26 +177,25 @@ static void fw_cfg_bootsplash(FWCfgState *s) static void fw_cfg_reboot(FWCfgState *s) { - int reboot_timeout = -1; - char *p; - const char *temp; + const char *reboot_timeout = NULL; + int64_t rt_val = -1; /* get user configuration */ QemuOptsList *plist = qemu_find_opts("boot-opts"); QemuOpts *opts = QTAILQ_FIRST(&plist->head); - if (opts != NULL) { - temp = qemu_opt_get(opts, "reboot-timeout"); - if (temp != NULL) { - p = (char *)temp; - reboot_timeout = strtol(p, &p, 10); + reboot_timeout = qemu_opt_get(opts, "reboot-timeout"); + + if (reboot_timeout) { + rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1); + /* validate the input */ + if (rt_val < 0 || rt_val > 0xffff) { + error_report("reboot timeout is invalid," + "it should be a value between 0 and 65535"); + exit(1); } } - /* validate the input */ - if (reboot_timeout > 0xffff) { - error_report("reboot timeout is larger than 65535, force it to 65535."); - reboot_timeout = 0xffff; - } - fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4); + + fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_val, 4), 4); } static void fw_cfg_write(FWCfgState *s, uint8_t value) diff --git a/vl.c b/vl.c index 96ac0ddcf6..38a1759461 100644 --- a/vl.c +++ b/vl.c @@ -339,7 +339,7 @@ static QemuOptsList qemu_boot_opts = { .type = QEMU_OPT_NUMBER, }, { .name = "reboot-timeout", - .type = QEMU_OPT_STRING, + .type = QEMU_OPT_NUMBER, }, { .name = "strict", .type = QEMU_OPT_BOOL,