* [PATCH] s390x/ipl: check kernel command line size
@ 2021-10-06 9:26 Marc Hartmayer
2021-10-06 17:34 ` Christian Borntraeger
2021-10-11 13:38 ` Thomas Huth
0 siblings, 2 replies; 6+ messages in thread
From: Marc Hartmayer @ 2021-10-06 9:26 UTC (permalink / raw)
To: qemu-devel
Cc: Christian Borntraeger, qemu-s390x, Cornelia Huck, Thomas Huth,
Sven Schnelle
Check if the provided kernel command line exceeds the maximum size of the s390x
Linux kernel command line size, which is 896 bytes.
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
---
hw/s390x/ipl.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 1821c6faeef3..a58ea58cc736 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -38,6 +38,7 @@
#define KERN_IMAGE_START 0x010000UL
#define LINUX_MAGIC_ADDR 0x010008UL
#define KERN_PARM_AREA 0x010480UL
+#define KERN_PARM_AREA_SIZE 0x000380UL
#define INITRD_START 0x800000UL
#define INITRD_PARM_START 0x010408UL
#define PARMFILE_START 0x001000UL
@@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
* loader) and it won't work. For this case we force it to 0x10000, too.
*/
if (pentry == KERN_IMAGE_START || pentry == 0x800) {
- char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
+ size_t cmdline_size = strlen(ipl->cmdline) + 1;
+ char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
+
ipl->start_addr = KERN_IMAGE_START;
/* Overwrite parameters in the kernel image, which are "rom" */
if (parm_area) {
+ if (cmdline_size > KERN_PARM_AREA_SIZE) {
+ error_setg(errp,
+ "kernel command line exceeds maximum size: %lu > %lu",
+ cmdline_size, KERN_PARM_AREA_SIZE);
+ return;
+ }
+
strcpy(parm_area, ipl->cmdline);
}
} else {
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] s390x/ipl: check kernel command line size
2021-10-06 9:26 [PATCH] s390x/ipl: check kernel command line size Marc Hartmayer
@ 2021-10-06 17:34 ` Christian Borntraeger
2021-10-11 13:38 ` Thomas Huth
1 sibling, 0 replies; 6+ messages in thread
From: Christian Borntraeger @ 2021-10-06 17:34 UTC (permalink / raw)
To: Marc Hartmayer, qemu-devel
Cc: qemu-s390x, Cornelia Huck, Thomas Huth, Sven Schnelle
Am 06.10.21 um 11:26 schrieb Marc Hartmayer:
> Check if the provided kernel command line exceeds the maximum size of the s390x
> Linux kernel command line size, which is 896 bytes.
>
> Reported-by: Sven Schnelle <svens@linux.ibm.com>
> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
> ---
> hw/s390x/ipl.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index 1821c6faeef3..a58ea58cc736 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -38,6 +38,7 @@
> #define KERN_IMAGE_START 0x010000UL
> #define LINUX_MAGIC_ADDR 0x010008UL
> #define KERN_PARM_AREA 0x010480UL
> +#define KERN_PARM_AREA_SIZE 0x000380UL
> #define INITRD_START 0x800000UL
> #define INITRD_PARM_START 0x010408UL
> #define PARMFILE_START 0x001000UL
> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
> * loader) and it won't work. For this case we force it to 0x10000, too.
> */
> if (pentry == KERN_IMAGE_START || pentry == 0x800) {
> - char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
> + size_t cmdline_size = strlen(ipl->cmdline) + 1;
> + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
> +
> ipl->start_addr = KERN_IMAGE_START;
> /* Overwrite parameters in the kernel image, which are "rom" */
> if (parm_area) {
> + if (cmdline_size > KERN_PARM_AREA_SIZE) {
> + error_setg(errp,
> + "kernel command line exceeds maximum size: %lu > %lu",
> + cmdline_size, KERN_PARM_AREA_SIZE);
> + return;
> + }
> +
> strcpy(parm_area, ipl->cmdline);
> }
> } else {
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] s390x/ipl: check kernel command line size
2021-10-06 9:26 [PATCH] s390x/ipl: check kernel command line size Marc Hartmayer
2021-10-06 17:34 ` Christian Borntraeger
@ 2021-10-11 13:38 ` Thomas Huth
2021-10-11 14:44 ` Marc Hartmayer
2021-10-11 18:08 ` Philippe Mathieu-Daudé
1 sibling, 2 replies; 6+ messages in thread
From: Thomas Huth @ 2021-10-11 13:38 UTC (permalink / raw)
To: Marc Hartmayer, qemu-devel
Cc: Christian Borntraeger, qemu-s390x, Cornelia Huck, Sven Schnelle
On 06/10/2021 11.26, Marc Hartmayer wrote:
> Check if the provided kernel command line exceeds the maximum size of the s390x
> Linux kernel command line size, which is 896 bytes.
>
> Reported-by: Sven Schnelle <svens@linux.ibm.com>
> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
> ---
> hw/s390x/ipl.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index 1821c6faeef3..a58ea58cc736 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -38,6 +38,7 @@
> #define KERN_IMAGE_START 0x010000UL
> #define LINUX_MAGIC_ADDR 0x010008UL
> #define KERN_PARM_AREA 0x010480UL
> +#define KERN_PARM_AREA_SIZE 0x000380UL
> #define INITRD_START 0x800000UL
> #define INITRD_PARM_START 0x010408UL
> #define PARMFILE_START 0x001000UL
> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
> * loader) and it won't work. For this case we force it to 0x10000, too.
> */
> if (pentry == KERN_IMAGE_START || pentry == 0x800) {
> - char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
> + size_t cmdline_size = strlen(ipl->cmdline) + 1;
> + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
> +
> ipl->start_addr = KERN_IMAGE_START;
> /* Overwrite parameters in the kernel image, which are "rom" */
> if (parm_area) {
> + if (cmdline_size > KERN_PARM_AREA_SIZE) {
> + error_setg(errp,
> + "kernel command line exceeds maximum size: %lu > %lu",
I think the first %lu should be %zd instead?
Apart from that, the patch looks fine to me... so if you agree, I can fix
that up when picking up the patch.
Thomas
> + cmdline_size, KERN_PARM_AREA_SIZE);
> + return;
> + }
> +
> strcpy(parm_area, ipl->cmdline);
> }
> } else {
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] s390x/ipl: check kernel command line size
2021-10-11 13:38 ` Thomas Huth
@ 2021-10-11 14:44 ` Marc Hartmayer
2021-10-11 18:08 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 6+ messages in thread
From: Marc Hartmayer @ 2021-10-11 14:44 UTC (permalink / raw)
To: Thomas Huth, Marc Hartmayer, qemu-devel
Cc: Christian Borntraeger, qemu-s390x, Cornelia Huck, Sven Schnelle
Thomas Huth <thuth@redhat.com> writes:
> On 06/10/2021 11.26, Marc Hartmayer wrote:
>> Check if the provided kernel command line exceeds the maximum size of the s390x
>> Linux kernel command line size, which is 896 bytes.
>>
>> Reported-by: Sven Schnelle <svens@linux.ibm.com>
>> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
>> ---
>> hw/s390x/ipl.c | 12 +++++++++++-
>> 1 file changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
>> index 1821c6faeef3..a58ea58cc736 100644
>> --- a/hw/s390x/ipl.c
>> +++ b/hw/s390x/ipl.c
>> @@ -38,6 +38,7 @@
>> #define KERN_IMAGE_START 0x010000UL
>> #define LINUX_MAGIC_ADDR 0x010008UL
>> #define KERN_PARM_AREA 0x010480UL
>> +#define KERN_PARM_AREA_SIZE 0x000380UL
>> #define INITRD_START 0x800000UL
>> #define INITRD_PARM_START 0x010408UL
>> #define PARMFILE_START 0x001000UL
>> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
>> * loader) and it won't work. For this case we force it to 0x10000, too.
>> */
>> if (pentry == KERN_IMAGE_START || pentry == 0x800) {
>> - char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
>> + size_t cmdline_size = strlen(ipl->cmdline) + 1;
>> + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
>> +
>> ipl->start_addr = KERN_IMAGE_START;
>> /* Overwrite parameters in the kernel image, which are "rom" */
>> if (parm_area) {
>> + if (cmdline_size > KERN_PARM_AREA_SIZE) {
>> + error_setg(errp,
>> + "kernel command line exceeds maximum size: %lu > %lu",
>
> I think the first %lu should be %zd instead?
Yep, makes sense - thanks!
>
> Apart from that, the patch looks fine to me... so if you agree, I can fix
> that up when picking up the patch.
Thanks.
>
> Thomas
>
>
>> + cmdline_size, KERN_PARM_AREA_SIZE);
>> + return;
>> + }
>> +
>> strcpy(parm_area, ipl->cmdline);
>> }
>> } else {
>>
>
--
Kind regards / Beste Grüße
Marc Hartmayer
IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Gregor Pillen
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] s390x/ipl: check kernel command line size
2021-10-11 13:38 ` Thomas Huth
2021-10-11 14:44 ` Marc Hartmayer
@ 2021-10-11 18:08 ` Philippe Mathieu-Daudé
2021-10-12 6:53 ` Thomas Huth
1 sibling, 1 reply; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-10-11 18:08 UTC (permalink / raw)
To: Thomas Huth, Marc Hartmayer, qemu-devel
Cc: Christian Borntraeger, qemu-s390x, Cornelia Huck, Sven Schnelle
On 10/11/21 15:38, Thomas Huth wrote:
> On 06/10/2021 11.26, Marc Hartmayer wrote:
>> Check if the provided kernel command line exceeds the maximum size of
>> the s390x
>> Linux kernel command line size, which is 896 bytes.
>>
>> Reported-by: Sven Schnelle <svens@linux.ibm.com>
>> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
>> ---
>> hw/s390x/ipl.c | 12 +++++++++++-
>> 1 file changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
>> index 1821c6faeef3..a58ea58cc736 100644
>> --- a/hw/s390x/ipl.c
>> +++ b/hw/s390x/ipl.c
>> @@ -38,6 +38,7 @@
>> #define KERN_IMAGE_START 0x010000UL
>> #define LINUX_MAGIC_ADDR 0x010008UL
>> #define KERN_PARM_AREA 0x010480UL
>> +#define KERN_PARM_AREA_SIZE 0x000380UL
>> #define INITRD_START 0x800000UL
>> #define INITRD_PARM_START 0x010408UL
>> #define PARMFILE_START 0x001000UL
>> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev,
>> Error **errp)
>> * loader) and it won't work. For this case we force it to
>> 0x10000, too.
>> */
>> if (pentry == KERN_IMAGE_START || pentry == 0x800) {
>> - char *parm_area = rom_ptr(KERN_PARM_AREA,
>> strlen(ipl->cmdline) + 1);
>> + size_t cmdline_size = strlen(ipl->cmdline) + 1;
>> + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
>> +
>> ipl->start_addr = KERN_IMAGE_START;
>> /* Overwrite parameters in the kernel image, which are
>> "rom" */
>> if (parm_area) {
>> + if (cmdline_size > KERN_PARM_AREA_SIZE) {
>> + error_setg(errp,
>> + "kernel command line exceeds maximum
>> size: %lu > %lu",
>
> I think the first %lu should be %zd instead?
%zu ;)
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>
> Apart from that, the patch looks fine to me... so if you agree, I can
> fix that up when picking up the patch.
>
> Thomas
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] s390x/ipl: check kernel command line size
2021-10-11 18:08 ` Philippe Mathieu-Daudé
@ 2021-10-12 6:53 ` Thomas Huth
0 siblings, 0 replies; 6+ messages in thread
From: Thomas Huth @ 2021-10-12 6:53 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, Marc Hartmayer, qemu-devel
Cc: Christian Borntraeger, qemu-s390x, Cornelia Huck, Sven Schnelle
On 11/10/2021 20.08, Philippe Mathieu-Daudé wrote:
> On 10/11/21 15:38, Thomas Huth wrote:
>> On 06/10/2021 11.26, Marc Hartmayer wrote:
>>> Check if the provided kernel command line exceeds the maximum size of
>>> the s390x
>>> Linux kernel command line size, which is 896 bytes.
>>>
>>> Reported-by: Sven Schnelle <svens@linux.ibm.com>
>>> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
>>> ---
>>> hw/s390x/ipl.c | 12 +++++++++++-
>>> 1 file changed, 11 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
>>> index 1821c6faeef3..a58ea58cc736 100644
>>> --- a/hw/s390x/ipl.c
>>> +++ b/hw/s390x/ipl.c
>>> @@ -38,6 +38,7 @@
>>> #define KERN_IMAGE_START 0x010000UL
>>> #define LINUX_MAGIC_ADDR 0x010008UL
>>> #define KERN_PARM_AREA 0x010480UL
>>> +#define KERN_PARM_AREA_SIZE 0x000380UL
>>> #define INITRD_START 0x800000UL
>>> #define INITRD_PARM_START 0x010408UL
>>> #define PARMFILE_START 0x001000UL
>>> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev,
>>> Error **errp)
>>> * loader) and it won't work. For this case we force it to
>>> 0x10000, too.
>>> */
>>> if (pentry == KERN_IMAGE_START || pentry == 0x800) {
>>> - char *parm_area = rom_ptr(KERN_PARM_AREA,
>>> strlen(ipl->cmdline) + 1);
>>> + size_t cmdline_size = strlen(ipl->cmdline) + 1;
>>> + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
>>> +
>>> ipl->start_addr = KERN_IMAGE_START;
>>> /* Overwrite parameters in the kernel image, which are
>>> "rom" */
>>> if (parm_area) {
>>> + if (cmdline_size > KERN_PARM_AREA_SIZE) {
>>> + error_setg(errp,
>>> + "kernel command line exceeds maximum
>>> size: %lu > %lu",
>>
>> I think the first %lu should be %zd instead?
>
> %zu ;)
All right, queued with %zu on my s390x-next branch:
https://gitlab.com/thuth/qemu/-/commits/s390x-next/
Thomas
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-10-12 6:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-06 9:26 [PATCH] s390x/ipl: check kernel command line size Marc Hartmayer
2021-10-06 17:34 ` Christian Borntraeger
2021-10-11 13:38 ` Thomas Huth
2021-10-11 14:44 ` Marc Hartmayer
2021-10-11 18:08 ` Philippe Mathieu-Daudé
2021-10-12 6:53 ` Thomas Huth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).