ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

s390/sclp: read sccb from mem based on provided length 

The header contained within the SCCB passed to the SCLP service call
contains the actual length of the SCCB. Instead of allocating a static
4K size for the work sccb, let's allow for a variable size determined
by the value in the header. The proper checks are already in place to
ensure the SCCB length is sufficent to store a full response and that
the length does not cross any explicitly-set boundaries.

Signed-off-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-Id: <20200915194416.107460-4-walling@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
This commit is contained in:
Collin Walling 2020-09-15 15:44:11 -04:00 committed by Cornelia Huck
parent db13387ca0
commit c1db53a591
3 changed files with 33 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/s390x/event-facility.c
View File

@ -213,7 +213,7 @@ static uint16_t handle_sccb_read_events(SCLPEventFacility *ef, SCCB *sccb,
event_buf = &red->ebh; event_buf = &red->ebh;
event_buf->length = 0; event_buf->length = 0;
slen = sizeof(sccb->data); slen = sccb_data_len(sccb);
rc = SCLP_RC_NO_EVENT_BUFFERS_STORED; rc = SCLP_RC_NO_EVENT_BUFFERS_STORED;

55
hw/s390x/sclp.c
View File

@ -231,25 +231,29 @@ int sclp_service_call_protected(CPUS390XState *env, uint64_t sccb,
{ {
SCLPDevice *sclp = get_sclp_device(); SCLPDevice *sclp = get_sclp_device();
SCLPDeviceClass *sclp_c = SCLP_GET_CLASS(sclp); SCLPDeviceClass *sclp_c = SCLP_GET_CLASS(sclp);
SCCB work_sccb; SCCBHeader header;
hwaddr sccb_len = sizeof(SCCB); g_autofree SCCB *work_sccb = NULL;
s390_cpu_pv_mem_read(env_archcpu(env), 0, &work_sccb, sccb_len); s390_cpu_pv_mem_read(env_archcpu(env), 0, &header, sizeof(SCCBHeader));
work_sccb = g_malloc0(be16_to_cpu(header.length));
s390_cpu_pv_mem_read(env_archcpu(env), 0, work_sccb,
be16_to_cpu(header.length));
if (!sclp_command_code_valid(code)) { if (!sclp_command_code_valid(code)) {
work_sccb.h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND); work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);
goto out_write; goto out_write;
} }
if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) { if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb->h.length))) {
work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); work_sccb->h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
goto out_write; goto out_write;
} }
sclp_c->execute(sclp, &work_sccb, code); sclp_c->execute(sclp, work_sccb, code);
out_write: out_write:
s390_cpu_pv_mem_write(env_archcpu(env), 0, &work_sccb, s390_cpu_pv_mem_write(env_archcpu(env), 0, work_sccb,
be16_to_cpu(work_sccb.h.length)); be16_to_cpu(work_sccb->h.length));
sclp_c->service_interrupt(sclp, SCLP_PV_DUMMY_ADDR); sclp_c->service_interrupt(sclp, SCLP_PV_DUMMY_ADDR);
return 0; return 0;
} }
@ -258,9 +262,8 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code)
{ {
SCLPDevice *sclp = get_sclp_device(); SCLPDevice *sclp = get_sclp_device();
SCLPDeviceClass *sclp_c = SCLP_GET_CLASS(sclp); SCLPDeviceClass *sclp_c = SCLP_GET_CLASS(sclp);
SCCB work_sccb; SCCBHeader header;
g_autofree SCCB *work_sccb = NULL;
hwaddr sccb_len = sizeof(SCCB);
/* first some basic checks on program checks */ /* first some basic checks on program checks */
if (env->psw.mask & PSW_MASK_PSTATE) { if (env->psw.mask & PSW_MASK_PSTATE) {
@ -274,32 +277,36 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code)
return -PGM_SPECIFICATION; return -PGM_SPECIFICATION;
} }
/* the header contains the actual length of the sccb */
cpu_physical_memory_read(sccb, &header, sizeof(SCCBHeader));
/* Valid sccb sizes */
if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) {
return -PGM_SPECIFICATION;
}
/* /*
* we want to work on a private copy of the sccb, to prevent guests * we want to work on a private copy of the sccb, to prevent guests
* from playing dirty tricks by modifying the memory content after * from playing dirty tricks by modifying the memory content after
* the host has checked the values * the host has checked the values
*/ */
cpu_physical_memory_read(sccb, &work_sccb, sccb_len); work_sccb = g_malloc0(be16_to_cpu(header.length));
cpu_physical_memory_read(sccb, work_sccb, be16_to_cpu(header.length));
/* Valid sccb sizes */
if (be16_to_cpu(work_sccb.h.length) < sizeof(SCCBHeader)) {
return -PGM_SPECIFICATION;
}
if (!sclp_command_code_valid(code)) { if (!sclp_command_code_valid(code)) {
work_sccb.h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND); work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);
goto out_write; goto out_write;
} }
if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) { if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb->h.length))) {
work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); work_sccb->h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
goto out_write; goto out_write;
} }
sclp_c->execute(sclp, &work_sccb, code); sclp_c->execute(sclp, work_sccb, code);
out_write: out_write:
cpu_physical_memory_write(sccb, &work_sccb, cpu_physical_memory_write(sccb, work_sccb,
be16_to_cpu(work_sccb.h.length)); be16_to_cpu(work_sccb->h.length));
sclp_c->service_interrupt(sclp, sccb); sclp_c->service_interrupt(sclp, sccb);

2
include/hw/s390x/sclp.h
View File

@ -178,7 +178,7 @@ typedef struct IoaCfgSccb {
typedef struct SCCB { typedef struct SCCB {
SCCBHeader h; SCCBHeader h;
char data[SCCB_DATA_LEN]; char data[];
} QEMU_PACKED SCCB; } QEMU_PACKED SCCB;
#define TYPE_SCLP "sclp" #define TYPE_SCLP "sclp"