|
 |
a19a21 |
From bc395a979a00bb3e16f3bd92b5b2006db4a5aee3 Mon Sep 17 00:00:00 2001
|
|
|
a19a21 |
From: Thomas Huth <thuth@redhat.com>
|
|
|
a19a21 |
Date: Wed, 11 Nov 2020 12:03:07 -0500
|
|
|
a19a21 |
Subject: [PATCH 07/18] s390/sclp: rework sclp boundary checks
|
|
|
a19a21 |
|
|
|
a19a21 |
RH-Author: Thomas Huth <thuth@redhat.com>
|
|
|
a19a21 |
Message-id: <20201111120316.707489-4-thuth@redhat.com>
|
|
|
a19a21 |
Patchwork-id: 99500
|
|
|
a19a21 |
O-Subject: [RHEL-8.4.0 qemu-kvm PATCH v2 03/12] s390/sclp: rework sclp boundary checks
|
|
|
a19a21 |
Bugzilla: 1798506
|
|
|
a19a21 |
RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
|
|
|
a19a21 |
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
|
|
|
a19a21 |
RH-Acked-by: David Hildenbrand <david@redhat.com>
|
|
|
a19a21 |
|
|
|
a19a21 |
From: Collin Walling <walling@linux.ibm.com>
|
|
|
a19a21 |
|
|
|
a19a21 |
Rework the SCLP boundary check to account for different SCLP commands
|
|
|
a19a21 |
(eventually) allowing different boundary sizes.
|
|
|
a19a21 |
|
|
|
a19a21 |
Signed-off-by: Collin Walling <walling@linux.ibm.com>
|
|
|
a19a21 |
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
|
|
|
a19a21 |
Reviewed-by: Thomas Huth <thuth@redhat.com>
|
|
|
a19a21 |
Acked-by: Janosch Frank <frankja@linux.ibm.com>
|
|
|
a19a21 |
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
|
|
|
a19a21 |
Message-Id: <20200915194416.107460-3-walling@linux.ibm.com>
|
|
|
a19a21 |
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
|
|
|
a19a21 |
(cherry picked from commit db13387ca01a69d870cc16dd232375c2603596f2)
|
|
|
a19a21 |
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
|
a19a21 |
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
|
a19a21 |
---
|
|
|
a19a21 |
hw/s390x/sclp.c | 19 ++++++++++++++++++-
|
|
|
a19a21 |
1 file changed, 18 insertions(+), 1 deletion(-)
|
|
|
a19a21 |
|
|
|
a19a21 |
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
|
|
|
a19a21 |
index fe7d0fece80..38278497319 100644
|
|
|
a19a21 |
--- a/hw/s390x/sclp.c
|
|
|
a19a21 |
+++ b/hw/s390x/sclp.c
|
|
|
a19a21 |
@@ -49,6 +49,18 @@ static inline bool sclp_command_code_valid(uint32_t code)
|
|
|
a19a21 |
return false;
|
|
|
a19a21 |
}
|
|
|
a19a21 |
|
|
|
a19a21 |
+static bool sccb_verify_boundary(uint64_t sccb_addr, uint16_t sccb_len)
|
|
|
a19a21 |
+{
|
|
|
a19a21 |
+ uint64_t sccb_max_addr = sccb_addr + sccb_len - 1;
|
|
|
a19a21 |
+ uint64_t sccb_boundary = (sccb_addr & PAGE_MASK) + PAGE_SIZE;
|
|
|
a19a21 |
+
|
|
|
a19a21 |
+ if (sccb_max_addr < sccb_boundary) {
|
|
|
a19a21 |
+ return true;
|
|
|
a19a21 |
+ }
|
|
|
a19a21 |
+
|
|
|
a19a21 |
+ return false;
|
|
|
a19a21 |
+}
|
|
|
a19a21 |
+
|
|
|
a19a21 |
static void prepare_cpu_entries(MachineState *ms, CPUEntry *entry, int *count)
|
|
|
a19a21 |
{
|
|
|
a19a21 |
uint8_t features[SCCB_CPU_FEATURE_LEN] = { 0 };
|
|
|
a19a21 |
@@ -229,6 +241,11 @@ int sclp_service_call_protected(CPUS390XState *env, uint64_t sccb,
|
|
|
a19a21 |
goto out_write;
|
|
|
a19a21 |
}
|
|
|
a19a21 |
|
|
|
a19a21 |
+ if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) {
|
|
|
a19a21 |
+ work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
|
|
|
a19a21 |
+ goto out_write;
|
|
|
a19a21 |
+ }
|
|
|
a19a21 |
+
|
|
|
a19a21 |
sclp_c->execute(sclp, &work_sccb, code);
|
|
|
a19a21 |
out_write:
|
|
|
a19a21 |
s390_cpu_pv_mem_write(env_archcpu(env), 0, &work_sccb,
|
|
|
a19a21 |
@@ -274,7 +291,7 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code)
|
|
|
a19a21 |
goto out_write;
|
|
|
a19a21 |
}
|
|
|
a19a21 |
|
|
|
a19a21 |
- if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) + PAGE_SIZE)) {
|
|
|
a19a21 |
+ if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) {
|
|
|
a19a21 |
work_sccb.h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
|
|
|
a19a21 |
goto out_write;
|
|
|
a19a21 |
}
|
|
|
a19a21 |
--
|
|
|
a19a21 |
2.27.0
|
|
|
a19a21 |
|