From patchwork Tue Sep 6 07:46:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cornelia Huck X-Patchwork-Id: 9315931 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 41D3B60752 for ; Tue, 6 Sep 2016 08:14:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4112F28BE4 for ; Tue, 6 Sep 2016 08:14:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 35E4B28BEA; Tue, 6 Sep 2016 08:14:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 2129828BE4 for ; Tue, 6 Sep 2016 08:14:01 +0000 (UTC) Received: from localhost ([::1]:59784 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhBW4-0007Mu-4o for patchwork-qemu-devel@patchwork.kernel.org; Tue, 06 Sep 2016 04:14:00 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38931) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhB6P-0001KR-CT for qemu-devel@nongnu.org; Tue, 06 Sep 2016 03:47:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bhB6H-0002DY-OY for qemu-devel@nongnu.org; Tue, 06 Sep 2016 03:47:28 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:55199) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhB6H-0002DE-FM for qemu-devel@nongnu.org; Tue, 06 Sep 2016 03:47:21 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u867hKlj063215 for ; Tue, 6 Sep 2016 03:47:20 -0400 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0a-001b2d01.pphosted.com with ESMTP id 259sn9042q-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 06 Sep 2016 03:47:20 -0400 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 6 Sep 2016 08:47:17 +0100 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp07.uk.ibm.com (192.168.101.137) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 6 Sep 2016 08:47:15 +0100 X-IBM-Helo: d06dlp03.portsmouth.uk.ibm.com X-IBM-MailFrom: cornelia.huck@de.ibm.com X-IBM-RcptTo: qemu-devel@nongnu.org;qemu-stable@nongnu.org Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id 35E781B08070; Tue, 6 Sep 2016 08:49:00 +0100 (BST) Received: from d06av06.portsmouth.uk.ibm.com (d06av06.portsmouth.uk.ibm.com [9.149.37.217]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u867lF6r8782098; Tue, 6 Sep 2016 07:47:15 GMT Received: from d06av06.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u867lEpk013418; Tue, 6 Sep 2016 03:47:14 -0400 Received: from gondolin.boeblingen.de.ibm.com (dyn-9-152-224-137.boeblingen.de.ibm.com [9.152.224.137]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id u867lCmU013216 (version=TLSv1/SSLv3 cipher=AES256-SHA256 bits=256 verify=NO); Tue, 6 Sep 2016 03:47:14 -0400 From: Cornelia Huck To: peter.maydell@linaro.org Date: Tue, 6 Sep 2016 09:46:39 +0200 X-Mailer: git-send-email 2.9.3 In-Reply-To: <20160906074710.13495-1-cornelia.huck@de.ibm.com> References: <20160906074710.13495-1-cornelia.huck@de.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16090607-0028-0000-0000-0000020EA883 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16090607-0029-0000-0000-00002030B780 Message-Id: <20160906074710.13495-8-cornelia.huck@de.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-09-06_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1609060120 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 07/38] s390x/css: handle cssid 255 correctly X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-devel@nongnu.org, qemu-stable@nongnu.org, agraf@suse.de, borntraeger@de.ibm.com, jfrei@linux.vnet.ibm.com, Cornelia Huck Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The cssid 255 is reserved but still valid from an architectural point of view. However, feeding a bogus schid of 0xffffffff into the virtio hypercall will lead to a crash: Stack trace of thread 138363: #0 0x00000000100d168c css_find_subch (qemu-system-s390x) #1 0x00000000100d3290 virtio_ccw_hcall_notify #2 0x00000000100cbf60 s390_virtio_hypercall #3 0x000000001010ff7a handle_hypercall #4 0x0000000010079ed4 kvm_cpu_exec (qemu-system-s390x) #5 0x00000000100609b4 qemu_kvm_cpu_thread_fn #6 0x000003ff8b887bb4 start_thread (libpthread.so.0) #7 0x000003ff8b78df0a thread_start (libc.so.6) This is because the css array was only allocated for 0..254 instead of 0..255. Let's fix this by bumping MAX_CSSID to 255 and fencing off the reserved cssid of 255 during css image allocation. Reported-by: Christian Borntraeger Tested-by: Christian Borntraeger Cc: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck --- hw/s390x/css.c | 8 +++----- include/hw/s390x/css.h | 2 +- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index bb8e4be..b0e81ef 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -141,7 +141,8 @@ out_err: int css_create_css_image(uint8_t cssid, bool default_image) { trace_css_new_image(cssid, default_image ? "(default)" : ""); - if (cssid > MAX_CSSID) { + /* 255 is reserved */ + if (cssid == 255) { return -EINVAL; } if (channel_subsys.css[cssid]) { @@ -1267,7 +1268,7 @@ bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid) uint8_t real_cssid; real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid; - if (real_cssid > MAX_CSSID || ssid > MAX_SSID || + if (ssid > MAX_SSID || !channel_subsys.css[real_cssid] || !channel_subsys.css[real_cssid]->sch_set[ssid]) { return true; @@ -1282,9 +1283,6 @@ static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type) CssImage *css; trace_css_chpid_add(cssid, chpid, type); - if (cssid > MAX_CSSID) { - return -EINVAL; - } css = channel_subsys.css[cssid]; if (!css) { return -EINVAL; diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h index 1da63e3..c96c862 100644 --- a/include/hw/s390x/css.h +++ b/include/hw/s390x/css.h @@ -20,7 +20,7 @@ #define MAX_DEVNO 65535 #define MAX_SCHID 65535 #define MAX_SSID 3 -#define MAX_CSSID 254 /* 255 is reserved */ +#define MAX_CSSID 255 #define MAX_CHPID 255 #define MAX_CIWS 62