From: "Philippe Mathieu-Daudé" <philmd@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Eduardo Habkost" <ehabkost@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
"Alistair Francis" <alistair@alistair23.me>,
"Mark Cave-Ayland" <mark.cave-ayland@ilande.co.uk>,
qemu-ppc@nongnu.org, "Gerd Hoffmann" <kraxel@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"David Gibson" <david@gibson.dropbear.id.au>,
"Philippe Mathieu-Daudé" <philmd@redhat.com>,
"Artyom Tarasenko" <atar4qemu@gmail.com>,
"Richard Henderson" <rth@twiddle.net>
Subject: [PATCH 0/5] hw/core/loader: Prohibit loading ROMs bigger than memory region
Date: Mon, 9 Mar 2020 15:43:48 +0100 [thread overview]
Message-ID: <20200309144353.26457-1-philmd@redhat.com> (raw)
This series fixes a bug where an user can load ROMs bigger
than the expected size. The bug is delayed after a reset where
rom_reset() can overflow the underlying memory regions.
Philippe Mathieu-Daudé (5):
hw/sparc64/niagara: Pass available memory region size to
add_rom_or_fail
hw/core/loader: Prohibit loading ROMs bigger than memory region
hw/core/loader: Provide rom_add_file() a 'max_size' argument
hw/core/loader: Restrict rom_add_file_mr() to available region size
hw/core/loader: Provide rom_add_file_fixed() a 'max_size' argument
include/hw/loader.h | 12 ++++++------
hw/core/loader.c | 24 +++++++++++++++++-------
hw/i386/x86.c | 2 +-
hw/ppc/sam460ex.c | 2 +-
hw/sparc64/niagara.c | 22 +++++++++++++---------
5 files changed, 38 insertions(+), 24 deletions(-)
--
2.21.1
next reply other threads:[~2020-03-09 14:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-09 14:43 Philippe Mathieu-Daudé [this message]
2020-03-09 14:43 ` [PATCH 1/5] hw/sparc64/niagara: Pass available memory region size to add_rom_or_fail Philippe Mathieu-Daudé
2020-03-09 14:43 ` [PATCH 2/5] hw/core/loader: Prohibit loading ROMs bigger than memory region Philippe Mathieu-Daudé
2020-03-09 14:48 ` Peter Maydell
2020-03-09 15:41 ` Philippe Mathieu-Daudé
2020-03-09 14:43 ` [PATCH 3/5] hw/core/loader: Provide rom_add_file() a 'max_size' argument Philippe Mathieu-Daudé
2020-03-09 17:44 ` Taylor Simpson
2020-03-09 14:43 ` [PATCH 4/5] hw/core/loader: Restrict rom_add_file_mr() to available region size Philippe Mathieu-Daudé
2020-03-09 14:43 ` [PATCH 5/5] hw/core/loader: Provide rom_add_file_fixed() a 'max_size' argument Philippe Mathieu-Daudé
2020-03-10 0:43 ` David Gibson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200309144353.26457-1-philmd@redhat.com \
--to=philmd@redhat.com \
--cc=alistair@alistair23.me \
--cc=atar4qemu@gmail.com \
--cc=david@gibson.dropbear.id.au \
--cc=ehabkost@redhat.com \
--cc=kraxel@redhat.com \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).