ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

s390x/ipl: Add type and length checks for IplParameterBlock values 

We can check for valid type and lengths of the IplParameterBlock fields
when receiving the struct from the guest.

Length of the IplParameterBlock can be less than 4K. To play safe we can
read and write only required amount of data.

Signed-off-by: Alexander Yarygin <yarygin@linux.vnet.ibm.com>
Reviewed-by: David Hildenband <dahi@linux.vnet.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
This commit is contained in:
Alexander Yarygin 2015-08-10 13:57:03 +03:00 committed by Cornelia Huck
parent 04ca4b92ec
commit 9946a9113c
2 changed files with 36 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hw/s390x/ipl.h
View File

@ -99,6 +99,27 @@ struct S390IPLState {
};
typedef struct S390IPLState S390IPLState;
#define S390_IPL_TYPE_FCP 0x00
#define S390_IPL_TYPE_CCW 0x02
#define S390_IPLB_MIN_CCW_LEN 200
#define S390_IPLB_MIN_FCP_LEN 384
static inline bool iplb_valid_len(IplParameterBlock *iplb)
{
return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock);
}
static inline bool iplb_valid_ccw(IplParameterBlock *iplb)
{
return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN &&
iplb->pbt == S390_IPL_TYPE_CCW;
}
static inline bool iplb_valid_fcp(IplParameterBlock *iplb)
{
return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN &&
iplb->pbt == S390_IPL_TYPE_FCP;
}
#endif

17
target-s390x/misc_helper.c
View File

@ -233,9 +233,22 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3)
return;
}
iplb = g_malloc0(sizeof(IplParameterBlock));
cpu_physical_memory_read(addr, iplb, S390_IPLB_MIN_CCW_LEN);
cpu_physical_memory_read(addr, iplb, sizeof(iplb->len));
if (!iplb_valid_len(iplb)) {
env->regs[r1 + 1] = DIAG_308_RC_INVALID;
goto out;
}
cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len));
if (!iplb_valid_ccw(iplb) && !iplb_valid_fcp(iplb)) {
env->regs[r1 + 1] = DIAG_308_RC_INVALID;
goto out;
}
s390_ipl_update_diag308(iplb);
env->regs[r1 + 1] = DIAG_308_RC_OK;
out:
g_free(iplb);
return;
case 6:
@ -250,7 +263,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3)
}
iplb = s390_ipl_get_iplb();
if (iplb) {
cpu_physical_memory_write(addr, iplb, S390_IPLB_MIN_CCW_LEN);
cpu_physical_memory_write(addr, iplb, be32_to_cpu(iplb->len));
env->regs[r1 + 1] = DIAG_308_RC_OK;
} else {
env->regs[r1 + 1] = DIAG_308_RC_NO_CONF;