From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51783) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b0Vao-0008Uq-8U for qemu-devel@nongnu.org; Wed, 11 May 2016 10:58:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1b0Vaf-0007KN-VK for qemu-devel@nongnu.org; Wed, 11 May 2016 10:58:30 -0400 Received: from e06smtp12.uk.ibm.com ([195.75.94.108]:34957) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b0Vaf-0007JT-Jq for qemu-devel@nongnu.org; Wed, 11 May 2016 10:58:21 -0400 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 11 May 2016 15:58:20 +0100 Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id EF45917D8042 for ; Wed, 11 May 2016 15:59:13 +0100 (BST) Received: from d06av11.portsmouth.uk.ibm.com (d06av11.portsmouth.uk.ibm.com [9.149.37.252]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u4BEwGZC56230072 for ; Wed, 11 May 2016 14:58:16 GMT Received: from d06av11.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av11.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u4BEwFs2000441 for ; Wed, 11 May 2016 08:58:16 -0600 From: Cornelia Huck Date: Wed, 11 May 2016 16:57:56 +0200 Message-Id: <1462978692-33738-5-git-send-email-cornelia.huck@de.ibm.com> In-Reply-To: <1462978692-33738-1-git-send-email-cornelia.huck@de.ibm.com> References: <1462978692-33738-1-git-send-email-cornelia.huck@de.ibm.com> Subject: [Qemu-devel] [PATCH v2 for-2.7 04/20] s390x/ipl: Add type and length checks for IplParameterBlock values List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: borntraeger@de.ibm.com, agraf@suse.de, jfrei@linux.vnet.ibm.com, Alexander Yarygin , Cornelia Huck From: Alexander Yarygin We can check for valid type and lengths of the IplParameterBlock fields when receiving the struct from the guest. Length of the IplParameterBlock can be less than 4K. To play safe we can read and write only required amount of data. Signed-off-by: Alexander Yarygin Reviewed-by: David Hildenband Acked-by: Christian Borntraeger Signed-off-by: Cornelia Huck --- hw/s390x/ipl.h | 21 +++++++++++++++++++++ target-s390x/misc_helper.c | 17 +++++++++++++++-- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 73b86e3..08f1d5c 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -99,6 +99,27 @@ struct S390IPLState { }; typedef struct S390IPLState S390IPLState; +#define S390_IPL_TYPE_FCP 0x00 +#define S390_IPL_TYPE_CCW 0x02 + #define S390_IPLB_MIN_CCW_LEN 200 +#define S390_IPLB_MIN_FCP_LEN 384 + +static inline bool iplb_valid_len(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock); +} + +static inline bool iplb_valid_ccw(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN && + iplb->pbt == S390_IPL_TYPE_CCW; +} + +static inline bool iplb_valid_fcp(IplParameterBlock *iplb) +{ + return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN && + iplb->pbt == S390_IPL_TYPE_FCP; +} #endif diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c index fab7f87..462cfc8 100644 --- a/target-s390x/misc_helper.c +++ b/target-s390x/misc_helper.c @@ -233,9 +233,22 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3) return; } iplb = g_malloc0(sizeof(IplParameterBlock)); - cpu_physical_memory_read(addr, iplb, S390_IPLB_MIN_CCW_LEN); + cpu_physical_memory_read(addr, iplb, sizeof(iplb->len)); + if (!iplb_valid_len(iplb)) { + env->regs[r1 + 1] = DIAG_308_RC_INVALID; + goto out; + } + + cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len)); + + if (!iplb_valid_ccw(iplb) && !iplb_valid_fcp(iplb)) { + env->regs[r1 + 1] = DIAG_308_RC_INVALID; + goto out; + } + s390_ipl_update_diag308(iplb); env->regs[r1 + 1] = DIAG_308_RC_OK; +out: g_free(iplb); return; case 6: @@ -250,7 +263,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3) } iplb = s390_ipl_get_iplb(); if (iplb) { - cpu_physical_memory_write(addr, iplb, S390_IPLB_MIN_CCW_LEN); + cpu_physical_memory_write(addr, iplb, be32_to_cpu(iplb->len)); env->regs[r1 + 1] = DIAG_308_RC_OK; } else { env->regs[r1 + 1] = DIAG_308_RC_NO_CONF; -- 2.6.6