From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43129) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XXStS-0005Ky-3q for qemu-devel@nongnu.org; Fri, 26 Sep 2014 06:37:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XXStK-0008E0-I9 for qemu-devel@nongnu.org; Fri, 26 Sep 2014 06:36:53 -0400 Received: from cantor2.suse.de ([195.135.220.15]:43806 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XXStK-0008De-Bp for qemu-devel@nongnu.org; Fri, 26 Sep 2014 06:36:46 -0400 Message-ID: <542541B6.1000009@suse.de> Date: Fri, 26 Sep 2014 12:36:38 +0200 From: =?ISO-8859-15?Q?Andreas_F=E4rber?= MIME-Version: 1.0 References: <1411474456-12226-1-git-send-email-borntraeger@de.ibm.com> <1411474456-12226-4-git-send-email-borntraeger@de.ibm.com> In-Reply-To: <1411474456-12226-4-git-send-email-borntraeger@de.ibm.com> Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PULL 3/3] s390x/css: catch ccw sequence errors List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Christian Borntraeger , Peter Maydell , Cornelia Huck Cc: Jens Freimann , Richard Henderson , qemu-devel , Alexander Graf Christian, Conny, Am 23.09.2014 um 14:14 schrieb Christian Borntraeger: > From: Cornelia Huck >=20 > We must not allow chains of more than 255 ccws without data transfer. >=20 > Reviewed-by: David Hildenbrand > Signed-off-by: Cornelia Huck > Signed-off-by: Jens Freimann > Signed-off-by: Christian Borntraeger > --- > hw/s390x/css.c | 10 ++++++++++ > hw/s390x/css.h | 1 + > 2 files changed, 11 insertions(+) >=20 > diff --git a/hw/s390x/css.c b/hw/s390x/css.c > index 34637cb..b67c039 100644 > --- a/hw/s390x/css.c > +++ b/hw/s390x/css.c > @@ -294,6 +294,13 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr= ccw_addr) > =20 > check_len =3D !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FL= AG_DC)); > =20 > + if (!ccw.cda) { > + if (sch->ccw_no_data_cnt =3D=3D 255) { > + return -EINVAL; > + } > + sch->ccw_no_data_cnt++; > + } > + > /* Look at the command. */ > switch (ccw.cmd_code) { > case CCW_CMD_NOOP: > @@ -396,6 +403,7 @@ static void sch_handle_start_func(SubchDev *sch, OR= B *orb) > return; > } > sch->ccw_fmt_1 =3D !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT); > + sch->ccw_no_data_cnt =3D 0; > } else { > s->ctrl &=3D ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND); > } > @@ -1358,6 +1366,7 @@ void subch_device_save(SubchDev *s, QEMUFile *f) > qemu_put_be16(f, s->id.ciw[i].count); > } > qemu_put_byte(f, s->ccw_fmt_1); > + qemu_put_byte(f, s->ccw_no_data_cnt); > return; > } > =20 > @@ -1414,6 +1423,7 @@ int subch_device_load(SubchDev *s, QEMUFile *f) > s->id.ciw[i].count =3D qemu_get_be16(f); > } > s->ccw_fmt_1 =3D qemu_get_byte(f); > + s->ccw_no_data_cnt =3D qemu_get_byte(f); > return 0; > } > =20 You need to bump the version saved if you add fields (same as VMState), and on load you need to check the version for whether to load the field (or deny loading). Regards, Andreas > diff --git a/hw/s390x/css.h b/hw/s390x/css.h > index 384a455..33104ac 100644 > --- a/hw/s390x/css.h > +++ b/hw/s390x/css.h > @@ -78,6 +78,7 @@ struct SubchDev { > bool last_cmd_valid; > bool ccw_fmt_1; > bool thinint_active; > + uint8_t ccw_no_data_cnt; > /* transport-provided data: */ > int (*ccw_cb) (SubchDev *, CCW1); > SenseId id; --=20 SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 N=FCrnberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imend=F6rffer; HRB 16746 AG N=FCrnbe= rg