[Qemu-devel] [PATCH v2] hw/s390x/ipl: Fix crashes that occurs when -kernel is used with small images

[Thomas Huth <thuth@redhat.com>]

Add a sanity checks to fix the following two crashes:

$ echo "Insane in the mainframe" > /tmp/test.txt
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
Segmentation fault (core dumped)
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
Segmentation fault (core dumped)

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 v2: Fixed 2nd crash with -initrd

 hw/s390x/ipl.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 04245b5..2ff8f20 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
          * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
          * loader) and it won't work. For this case we force it to 0x10000, too.
          */
-        if (pentry == KERN_IMAGE_START || pentry == 0x800) {
+        if ((pentry == KERN_IMAGE_START || pentry == 0x800) &&
+            kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) {
             ipl->start_addr = KERN_IMAGE_START;
             /* Overwrite parameters in the kernel image, which are "rom" */
             strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline);
@@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
              * we have to overwrite values in the kernel image,
              * which are "rom"
              */
-            stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
-            stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
+            if (kernel_size > INITRD_PARM_SIZE + 8) {
+                stq_p(rom_ptr(INITRD_PARM_START), initrd_offset);
+                stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size);
+            }
         }
     }
     /*
-- 
1.8.3.1