Re: [PATCH] s390x/ipl: check kernel command line size

[Thomas Huth <thuth@redhat.com>]

On 11/10/2021 20.08, Philippe Mathieu-Daudé wrote:
> On 10/11/21 15:38, Thomas Huth wrote:
>> On 06/10/2021 11.26, Marc Hartmayer wrote:
>>> Check if the provided kernel command line exceeds the maximum size of
>>> the s390x
>>> Linux kernel command line size, which is 896 bytes.
>>>
>>> Reported-by: Sven Schnelle <svens@linux.ibm.com>
>>> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
>>> ---
>>>    hw/s390x/ipl.c | 12 +++++++++++-
>>>    1 file changed, 11 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
>>> index 1821c6faeef3..a58ea58cc736 100644
>>> --- a/hw/s390x/ipl.c
>>> +++ b/hw/s390x/ipl.c
>>> @@ -38,6 +38,7 @@
>>>    #define KERN_IMAGE_START                0x010000UL
>>>    #define LINUX_MAGIC_ADDR                0x010008UL
>>>    #define KERN_PARM_AREA                  0x010480UL
>>> +#define KERN_PARM_AREA_SIZE             0x000380UL
>>>    #define INITRD_START                    0x800000UL
>>>    #define INITRD_PARM_START               0x010408UL
>>>    #define PARMFILE_START                  0x001000UL
>>> @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev,
>>> Error **errp)
>>>             * loader) and it won't work. For this case we force it to
>>> 0x10000, too.
>>>             */
>>>            if (pentry == KERN_IMAGE_START || pentry == 0x800) {
>>> -            char *parm_area = rom_ptr(KERN_PARM_AREA,
>>> strlen(ipl->cmdline) + 1);
>>> +            size_t cmdline_size = strlen(ipl->cmdline) + 1;
>>> +            char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
>>> +
>>>                ipl->start_addr = KERN_IMAGE_START;
>>>                /* Overwrite parameters in the kernel image, which are
>>> "rom" */
>>>                if (parm_area) {
>>> +                if (cmdline_size > KERN_PARM_AREA_SIZE) {
>>> +                    error_setg(errp,
>>> +                               "kernel command line exceeds maximum
>>> size: %lu > %lu",
>>
>> I think the first %lu should be %zd instead?
> 
> %zu ;)

All right, queued with %zu on my s390x-next branch:

  https://gitlab.com/thuth/qemu/-/commits/s390x-next/

  Thomas