[Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[Greg Kurz]

If a guest passes the reg property of a valid VIO object that is not a VTY
to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
assertion and aborts.

PAPR+ says "Hypervisor checks the termno parameter for validity against the
Vterm IOA unit addresses assigned to the partition, else return H_Parameter."

This patch adds a type check to ensure vty_lookup() either returns a pointer
to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
now return H_PARAMETER to the guest instead of crashing.

The patch has no effect on the reg == 0 hack used to implement the RTAS call
display-character.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
---
 hw/char/spapr_vty.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 4e464bd15a54..7eeacde31d27 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg)
         return spapr_vty_get_default(spapr->vio_bus);
     }
 
-    return sdev;
+    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
 }
 
 static void spapr_vty_register_types(void)

Re: [Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[Greg Kurz]

On Tue, 30 Jun 2015 14:04:31 +0200
Greg Kurz <gkurz@linux.vnet.ibm.com> wrote:
> If a guest passes the reg property of a valid VIO object that is not a VTY
> to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
> assertion and aborts.
> 
> PAPR+ says "Hypervisor checks the termno parameter for validity against the
> Vterm IOA unit addresses assigned to the partition, else return H_Parameter."
> 
> This patch adds a type check to ensure vty_lookup() either returns a pointer
> to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
> now return H_PARAMETER to the guest instead of crashing.
> 
> The patch has no effect on the reg == 0 hack used to implement the RTAS call
> display-character.
> 
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
> ---

Oops I forgot to Cc: the QEMU PPC mailing list...

>  hw/char/spapr_vty.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
> index 4e464bd15a54..7eeacde31d27 100644
> --- a/hw/char/spapr_vty.c
> +++ b/hw/char/spapr_vty.c
> @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg)
>          return spapr_vty_get_default(spapr->vio_bus);
>      }
> 
> -    return sdev;
> +    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
>  }
> 
>  static void spapr_vty_register_types(void)
> 
> 

Re: [Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1703 bytes --]

On Tue, Jun 30, 2015 at 02:04:31PM +0200, Greg Kurz wrote:
> If a guest passes the reg property of a valid VIO object that is not a VTY
> to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
> assertion and aborts.
> 
> PAPR+ says "Hypervisor checks the termno parameter for validity against the
> Vterm IOA unit addresses assigned to the partition, else return H_Parameter."
> 
> This patch adds a type check to ensure vty_lookup() either returns a pointer
> to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
> now return H_PARAMETER to the guest instead of crashing.
> 
> The patch has no effect on the reg == 0 hack used to implement the RTAS call
> display-character.
> 
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>

Ouch.  That's a nasty bug that's been in there for a long time.

I've applied this to spapr-next.  We should also push to the stable
branch.

> ---
>  hw/char/spapr_vty.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
> index 4e464bd15a54..7eeacde31d27 100644
> --- a/hw/char/spapr_vty.c
> +++ b/hw/char/spapr_vty.c
> @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg)
>          return spapr_vty_get_default(spapr->vio_bus);
>      }
>  
> -    return sdev;
> +    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
>  }
>  
>  static void spapr_vty_register_types(void)
> 

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

[Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[David Gibson]

From: Greg Kurz <gkurz@linux.vnet.ibm.com>

If a guest passes the reg property of a valid VIO object that is not a VTY
to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
assertion and aborts.

PAPR+ says "Hypervisor checks the termno parameter for validity against the
Vterm IOA unit addresses assigned to the partition, else return H_Parameter."

This patch adds a type check to ensure vty_lookup() either returns a pointer
to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
now return H_PARAMETER to the guest instead of crashing.

The patch has no effect on the reg == 0 hack used to implement the RTAS call
display-character.

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 hw/char/spapr_vty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

I've already merged this into spapr-next and it will be in the next
batch I send if not merged before that.

But I think this is an important enough fix (it allows the guest to
crash qemu) that it should probably be fastracked into mainline and
stable.

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1d53035..f407cd0 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPRMachineState *spapr, target_ulong reg)
         return spapr_vty_get_default(spapr->vio_bus);
     }
 
-    return sdev;
+    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
 }
 
 static void spapr_vty_register_types(void)
-- 
2.4.3

Re: [Qemu-devel] [PATCH] spapr_vty: lookup should only return valid VTY objects

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 1978 bytes --]

Ugh, sorry, this version is buggy, I'll resend.

On Wed, Jul 01, 2015 at 01:51:43PM +1000, David Gibson wrote:
> From: Greg Kurz <gkurz@linux.vnet.ibm.com>
> 
> If a guest passes the reg property of a valid VIO object that is not a VTY
> to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
> assertion and aborts.
> 
> PAPR+ says "Hypervisor checks the termno parameter for validity against the
> Vterm IOA unit addresses assigned to the partition, else return H_Parameter."
> 
> This patch adds a type check to ensure vty_lookup() either returns a pointer
> to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
> now return H_PARAMETER to the guest instead of crashing.
> 
> The patch has no effect on the reg == 0 hack used to implement the RTAS call
> display-character.
> 
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>  hw/char/spapr_vty.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> I've already merged this into spapr-next and it will be in the next
> batch I send if not merged before that.
> 
> But I think this is an important enough fix (it allows the guest to
> crash qemu) that it should probably be fastracked into mainline and
> stable.
> 
> diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
> index 1d53035..f407cd0 100644
> --- a/hw/char/spapr_vty.c
> +++ b/hw/char/spapr_vty.c
> @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPRMachineState *spapr, target_ulong reg)
>          return spapr_vty_get_default(spapr->vio_bus);
>      }
>  
> -    return sdev;
> +    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
>  }
>  
>  static void spapr_vty_register_types(void)

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]