From: Cornelia Huck <cohuck@redhat.com>
To: Thomas Huth <thuth@redhat.com>
Cc: qemu-devel@nongnu.org,
Christian Borntraeger <borntraeger@de.ibm.com>,
qemu-s390x@nongnu.org, qemu-arm@nongnu.org,
Yongbok Kim <yongbok.kim@mips.com>,
Aurelien Jarno <aurelien@aurel32.net>,
Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
Artyom Tarasenko <atar4qemu@gmail.com>,
Peter Maydell <peter.maydell@linaro.org>,
Paolo Bonzini <pbonzini@redhat.com>,
qemu-trivial@nongnu.org
Subject: Re: [Qemu-devel] [PATCH] loader: Check access size when calling rom_ptr() to avoid crashes
Date: Fri, 15 Jun 2018 09:57:52 +0200 [thread overview]
Message-ID: <20180615095752.536f4642.cohuck@redhat.com> (raw)
In-Reply-To: <1529045897-25260-1-git-send-email-thuth@redhat.com>
On Fri, 15 Jun 2018 08:58:17 +0200
Thomas Huth <thuth@redhat.com> wrote:
> The rom_ptr() function allows direct access to the ROM blobs that we
> load during startup. However, there are currently no checks for the
> size of the accesses, so it's currently possible to crash QEMU for
> example with:
>
> $ echo "Insane in the mainframe" > /tmp/test.txt
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
> Segmentation fault (core dumped)
> $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
> Segmentation fault (core dumped)
It seems nobody managed to trigger the other places yet?
>
> We need a possibility to check the size of the ROM area that we want
> to access, thus let's add a size parameter to the rom_ptr() function
> to avoid these problems.
Makes sense.
>
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
> hw/core/loader.c | 10 +++++-----
> hw/mips/mips_malta.c | 6 ++++--
> hw/s390x/ipl.c | 13 ++++++++++---
> hw/sparc/sun4m.c | 2 +-
> hw/sparc64/sun4u.c | 2 +-
> include/hw/loader.h | 2 +-
> target/arm/cpu.c | 2 +-
> 7 files changed, 23 insertions(+), 14 deletions(-)
>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
next prev parent reply other threads:[~2018-06-15 7:58 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-15 6:58 [Qemu-devel] [PATCH] loader: Check access size when calling rom_ptr() to avoid crashes Thomas Huth
2018-06-15 7:57 ` Cornelia Huck [this message]
2018-06-15 8:22 ` Thomas Huth
2018-06-15 8:33 ` Thomas Huth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180615095752.536f4642.cohuck@redhat.com \
--to=cohuck@redhat.com \
--cc=atar4qemu@gmail.com \
--cc=aurelien@aurel32.net \
--cc=borntraeger@de.ibm.com \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=qemu-trivial@nongnu.org \
--cc=thuth@redhat.com \
--cc=yongbok.kim@mips.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.