From: Thomas Huth <thuth@redhat.com>
To: qemu-devel@nongnu.org, Richard Henderson <richard.henderson@linaro.org>
Cc: qemu-s390x@nongnu.org, Cornelia Huck <cohuck@redhat.com>
Subject: [PULL 1/6] s390x/ipl: check kernel command line size
Date: Fri, 15 Oct 2021 11:16:17 +0200 [thread overview]
Message-ID: <20211015091622.1302433-2-thuth@redhat.com> (raw)
In-Reply-To: <20211015091622.1302433-1-thuth@redhat.com>
From: Marc Hartmayer <mhartmay@linux.ibm.com>
Check if the provided kernel command line exceeds the maximum size of the s390x
Linux kernel command line size, which is 896 bytes.
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Message-Id: <20211006092631.20732-1-mhartmay@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
[thuth: Adjusted format specifier for size_t]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
hw/s390x/ipl.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 1821c6faee..7ddca0127f 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -38,6 +38,7 @@
#define KERN_IMAGE_START 0x010000UL
#define LINUX_MAGIC_ADDR 0x010008UL
#define KERN_PARM_AREA 0x010480UL
+#define KERN_PARM_AREA_SIZE 0x000380UL
#define INITRD_START 0x800000UL
#define INITRD_PARM_START 0x010408UL
#define PARMFILE_START 0x001000UL
@@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
* loader) and it won't work. For this case we force it to 0x10000, too.
*/
if (pentry == KERN_IMAGE_START || pentry == 0x800) {
- char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
+ size_t cmdline_size = strlen(ipl->cmdline) + 1;
+ char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size);
+
ipl->start_addr = KERN_IMAGE_START;
/* Overwrite parameters in the kernel image, which are "rom" */
if (parm_area) {
+ if (cmdline_size > KERN_PARM_AREA_SIZE) {
+ error_setg(errp,
+ "kernel command line exceeds maximum size: %zu > %lu",
+ cmdline_size, KERN_PARM_AREA_SIZE);
+ return;
+ }
+
strcpy(parm_area, ipl->cmdline);
}
} else {
--
2.27.0
next prev parent reply other threads:[~2021-10-15 9:27 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-15 9:16 [PULL 0/6] s390x patches and dtc update Thomas Huth
2021-10-15 9:16 ` Thomas Huth [this message]
2021-10-15 9:16 ` [PULL 2/6] s390x: sigp: Force Set Architecture to return Invalid Parameter Thomas Huth
2021-10-15 9:16 ` [PULL 3/6] vfio-ccw: step down as maintainer Thomas Huth
2021-10-15 9:16 ` [PULL 4/6] s390x/kvm: " Thomas Huth
2021-10-15 9:16 ` [PULL 5/6] s390x virtio-ccw machine: " Thomas Huth
2021-10-15 9:16 ` [PULL 6/6] dtc: Update to version 1.6.1 Thomas Huth
2021-10-15 19:08 ` [PULL 0/6] s390x patches and dtc update Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211015091622.1302433-2-thuth@redhat.com \
--to=thuth@redhat.com \
--cc=cohuck@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.