mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

spapr: Fail CAS if option vector table cannot be parsed

Browse Source 
Most of the option vector helpers have assertions to check their
arguments aren't null. The guest can provide an arbitrary address
for the CAS structure that would result in such null arguments.
Fail CAS with H_PARAMETER and print a warning instead of aborting
QEMU.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <157925255250.397143.10855183619366882459.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
Greg Kurz 2020-01-17 10:15:52 +01:00 committed by David Gibson
parent 6e0552a3a7
commit cbd0d7f363
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/ppc/spapr_hcall.c
View File

@ -1703,7 +1703,15 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
ov_table = addr; ov_table = addr;
ov1_guest = spapr_ovec_parse_vector(ov_table, 1); ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
if (!ov1_guest) {
warn_report("guest didn't provide option vector 1");
return H_PARAMETER;
}
ov5_guest = spapr_ovec_parse_vector(ov_table, 5); ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
if (!ov5_guest) {
warn_report("guest didn't provide option vector 5");
return H_PARAMETER;
}
if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) { if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
error_report("guest requested hash and radix MMU, which is invalid."); error_report("guest requested hash and radix MMU, which is invalid.");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);