From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48853) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm7k-0006JT-0F for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:35:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZKm7g-0002hD-JM for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:35:43 -0400 Received: from e38.co.us.ibm.com ([32.97.110.159]:50564) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm7g-0002gy-1h for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:35:40 -0400 Received: from /spool/local by e38.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 30 Jul 2015 05:35:39 -0600 From: Michael Roth Date: Thu, 30 Jul 2015 06:32:54 -0500 Message-Id: <1438255988-10418-40-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 39/53] spapr_vty: lookup should only return valid VTY objects List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Alexander Graf , Greg Kurz , qemu-stable@nongnu.org, David Gibson From: David Gibson If a guest passes the reg property of a valid VIO object that is not a VTY to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast assertion and aborts. PAPR+ says "Hypervisor checks the termno parameter for validity against the Vterm IOA unit addresses assigned to the partition, else return H_Parameter." This patch adds a type check to ensure vty_lookup() either returns a pointer to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will now return H_PARAMETER to the guest instead of crashing. The patch has no effect on the reg == 0 hack used to implement the RTAS call display-character. Signed-off-by: Greg Kurz Signed-off-by: David Gibson Signed-off-by: Alexander Graf (cherry picked from commit 0f888bfaddfc5f55b0d82cde2e1164658a672375) Signed-off-by: Michael Roth --- hw/char/spapr_vty.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c index 4e464bd..c7f824e 100644 --- a/hw/char/spapr_vty.c +++ b/hw/char/spapr_vty.c @@ -228,6 +228,10 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg) return spapr_vty_get_default(spapr->vio_bus); } + if (!object_dynamic_cast(OBJECT(sdev), TYPE_VIO_SPAPR_VTY_DEVICE)) { + return NULL; + } + return sdev; } -- 1.9.1