qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: David Gibson <david@gibson.dropbear.id.au>
To: peter.maydell@linaro.org
Cc: ehabkost@redhat.com, agraf@suse.de, imammedo@redhat.com,
	groug@kaod.org, qemu-ppc@nongnu.org, qemu-devel@nongnu.org,
	David Gibson <david@gibson.dropbear.id.au>
Subject: [Qemu-devel] [PULL 05/34] spapr: sanity check size of the CAS buffer
Date: Tue, 17 Oct 2017 15:21:23 +1100	[thread overview]
Message-ID: <20171017042152.29443-6-david@gibson.dropbear.id.au> (raw)
In-Reply-To: <20171017042152.29443-1-david@gibson.dropbear.id.au>

From: Greg Kurz <groug@kaod.org>

The CAS buffer is provided by SLOF. A broken SLOF could pass a silly
size: either smaller than the diff header, in which case the current
code will try to allocate 16 Exabytes of memory and g_malloc0() will
abort, or bigger than the maximum memory provisioned for SLOF (ie,
40 Megabytes), which doesn't make sense. Both cases indicate that
SLOF has a bug.

Let's print out an explicit error message and exit since rebooting as
we do with other errors would only result in a reset loop.

Signed-off-by: Greg Kurz <groug@kaod.org>
[dwg: Fix format specifier that broke 32-bit builds]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 hw/ppc/spapr.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index b284e0b9d4..079e493ef4 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -819,6 +819,13 @@ int spapr_h_cas_compose_response(sPAPRMachineState *spapr,
         return 1;
     }
 
+    if (size < sizeof(hdr) || size > FW_MAX_SIZE) {
+        error_report("SLOF provided an unexpected CAS buffer size "
+                     TARGET_FMT_lu " (min: %zu, max: %u)",
+                     size, sizeof(hdr), FW_MAX_SIZE);
+        exit(EXIT_FAILURE);
+    }
+
     size -= sizeof(hdr);
 
     /* Create skeleton */
-- 
2.13.6

  parent reply	other threads:[~2017-10-17  4:22 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-17  4:21 [Qemu-devel] [PULL 00/34] ppc-for-2.11 queue 20171017 David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 01/34] macio: add missing registers to VMStateDescription David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 02/34] hw/ppc: use 0 instead of fdt_path_offset(fdt, "/") David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 03/34] target/ppc: Remove unused PPC 460 and 460F definitions David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 04/34] spapr: fix OF word name in comment David Gibson
2017-10-17  4:21 ` David Gibson [this message]
2017-10-17  4:21 ` [Qemu-devel] [PULL 06/34] target/ppc: Add POWER9 DD2.0 model information David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 07/34] target/ppc: Fix carry flag setting for shift algebraic instructions David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 08/34] hw/ppc/spapr.c: abort unplug_request if previous unplug isn't done David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 09/34] qom: introduce type_register_static_array() David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 10/34] qom: add helper macro DEFINE_TYPES() David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 11/34] ppc: mpc8544ds/e500plat: use generic cpu_model parsing David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 12/34] ppc: mac_newworld: " David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 13/34] ppc: mac_oldworld: " David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 14/34] ppc: bamboo: " David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 15/34] ppc: replace cpu_model with cpu_type on ref405ep, taihu boards David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 16/34] ppc: virtex-ml507: replace cpu_model with cpu_type David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 17/34] ppc: 40p/prep: " David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 18/34] ppc: spapr: replace ppc_cpu_parse_features() with cpu_parse_cpu_model() David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 19/34] ppc: move '-cpu foo, compat=xxx' parsing into ppc_cpu_parse_featurestr() David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 20/34] ppc: spapr: define core types statically David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 21/34] ppc: spapr: use cpu type name directly David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 22/34] ppc: spapr: register 'host' core type along with the rest of core types David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 23/34] ppc: spapr: use cpu model names as tcg defaults instead of aliases David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 24/34] ppc: move ppc_cpu_lookup_alias() before its first user David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 25/34] ppc: spapr: use generic cpu_model parsing David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 26/34] ppc: pnv: " David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 27/34] ppc: pnv: normalize core/chip type names David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 28/34] ppc: pnv: drop PnvCoreClass::cpu_oc field David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 29/34] ppc: pnv: define core types statically David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 30/34] ppc: pnv: drop PnvChipClass::cpu_model field David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 31/34] ppc: pnv: consolidate type definitions and batch register them David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 32/34] spapr: Correct RAM size calculation for HPT resizing David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 33/34] spapr_pci: fail gracefully with non-pseries machine types David Gibson
2017-10-17  4:21 ` [Qemu-devel] [PULL 34/34] spapr_cpu_core: rewrite machine type sanity check David Gibson
2017-10-19  9:52 ` [Qemu-devel] [PULL 00/34] ppc-for-2.11 queue 20171017 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171017042152.29443-6-david@gibson.dropbear.id.au \
    --to=david@gibson.dropbear.id.au \
    --cc=agraf@suse.de \
    --cc=ehabkost@redhat.com \
    --cc=groug@kaod.org \
    --cc=imammedo@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-ppc@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).