From: Collin Walling <walling@linux.ibm.com>
To: Thomas Huth <thuth@redhat.com>,
qemu-devel@nongnu.org, qemu-s390x@nongnu.org
Cc: frankja@linux.ibm.com, david@redhat.com, cohuck@redhat.com,
pasic@linux.ibm.com, borntraeger@de.ibm.com, mst@redhat.com,
svens@linux.ibm.com, pbonzini@redhat.com, mihajlov@linux.ibm.com,
rth@twiddle.net
Subject: Re: [PATCH v2 2/8] s390/sclp: check sccb len before filling in data
Date: Mon, 15 Jun 2020 11:47:48 -0400 [thread overview]
Message-ID: <58bd2552-8cb9-5914-dbfd-a6a05ffdf396@linux.ibm.com> (raw)
In-Reply-To: <ad9bd716-745b-210f-8716-46043ca1b110@redhat.com>
On 6/11/20 8:01 AM, Thomas Huth wrote:
> On 16/05/2020 00.20, Collin Walling wrote:
>> The SCCB must be checked for a sufficient length before it is filled
>> with any data. If the length is insufficient, then the SCLP command
>> is suppressed and the proper response code is set in the SCCB header.
>>
>> Fixes: 832be0d8a3bb ("s390x: sclp: Report insufficient SCCB length")
>> Signed-off-by: Collin Walling <walling@linux.ibm.com>
>> ---
>> hw/s390x/sclp.c | 22 ++++++++++------------
>> 1 file changed, 10 insertions(+), 12 deletions(-)
>>
>> diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
>> index 61e2e2839c..2bd618515e 100644
>> --- a/hw/s390x/sclp.c
>> +++ b/hw/s390x/sclp.c
>> @@ -75,6 +75,11 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
>> int rnsize, rnmax;
>> IplParameterBlock *ipib = s390_ipl_get_iplb();
>>
>> + if (be16_to_cpu(sccb->h.length) < (sizeof(ReadInfo) + cpu_count * sizeof(CPUEntry))) {
>
> You are using cpu_count here ...
>
>> + sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
>> + return;
>> + }
>> +
>> /* CPU information */
>> prepare_cpu_entries(machine, read_info->entries, &cpu_count);
>
> ... but it is only initialized here.
>
> Even if you replace the code in a later patch, please fix this here,
> too, to maintain bisectability of the code.
>
>> read_info->entries_cpu = cpu_to_be16(cpu_count);
>> @@ -83,12 +88,6 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
>>
>> read_info->ibc_val = cpu_to_be32(s390_get_ibc_val());
>>
>> - if (be16_to_cpu(sccb->h.length) <
>> - (sizeof(ReadInfo) + cpu_count * sizeof(CPUEntry))) {
>> - sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
>> - return;
>> - }
>> -
>> /* Configuration Characteristic (Extension) */
>> s390_get_feat_block(S390_FEAT_TYPE_SCLP_CONF_CHAR,
>> read_info->conf_char);
>> @@ -135,17 +134,16 @@ static void sclp_read_cpu_info(SCLPDevice *sclp, SCCB *sccb)
>> ReadCpuInfo *cpu_info = (ReadCpuInfo *) sccb;
>> int cpu_count;
>>
>> + if (be16_to_cpu(sccb->h.length) < (sizeof(ReadCpuInfo) + cpu_count * sizeof(CPUEntry))) {
>
> dito!
>
>> + sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
>> + return;
>> + }
>> +
>> prepare_cpu_entries(machine, cpu_info->entries, &cpu_count);
>> cpu_info->nr_configured = cpu_to_be16(cpu_count);
>> cpu_info->offset_configured = cpu_to_be16(offsetof(ReadCpuInfo, entries));
>> cpu_info->nr_standby = cpu_to_be16(0);
>>
>> - if (be16_to_cpu(sccb->h.length) <
>> - (sizeof(ReadCpuInfo) + cpu_count * sizeof(CPUEntry))) {
>> - sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
>> - return;
>> - }
>> -
>> /* The standby offset is 16-byte for each CPU */
>> cpu_info->offset_standby = cpu_to_be16(cpu_info->offset_configured
>> + cpu_info->nr_configured*sizeof(CPUEntry));
>
> Thanks,
> Thomas
>
I'll rework this patch. Thanks for the reviews!
--
Regards,
Collin
Stay safe and stay healthy
next prev parent reply other threads:[~2020-06-15 15:49 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-15 22:20 [PATCH v2 0/8] s390: Extended-Length SCCB & DIAGNOSE 0x318 Collin Walling
2020-05-15 22:20 ` [PATCH v2 1/8] s390/sclp: get machine once during read scp/cpu info Collin Walling
2020-05-18 8:38 ` David Hildenbrand
2020-05-18 17:30 ` Collin Walling
2020-06-11 11:33 ` Thomas Huth
2020-05-15 22:20 ` [PATCH v2 2/8] s390/sclp: check sccb len before filling in data Collin Walling
2020-05-18 8:37 ` Janosch Frank
2020-05-18 11:46 ` David Hildenbrand
2020-05-18 14:32 ` Collin Walling
2020-05-18 15:43 ` David Hildenbrand
2020-05-18 17:31 ` Collin Walling
2020-06-11 12:01 ` Thomas Huth
2020-06-15 15:47 ` Collin Walling [this message]
2020-05-15 22:20 ` [PATCH v2 3/8] s390/sclp: rework sclp boundary and length checks Collin Walling
2020-05-18 8:50 ` Janosch Frank
2020-05-18 15:15 ` Collin Walling
2020-05-19 13:19 ` Cornelia Huck
2020-05-25 10:53 ` Janosch Frank
2020-06-11 12:56 ` Thomas Huth
2020-06-15 15:47 ` Collin Walling
2020-05-15 22:20 ` [PATCH v2 4/8] s390/sclp: read sccb from mem based on sccb length Collin Walling
2020-06-11 13:05 ` Thomas Huth
2020-05-15 22:20 ` [PATCH v2 5/8] s390/sclp: use cpu offset to locate cpu entries Collin Walling
2020-06-11 14:33 ` Thomas Huth
2020-05-15 22:20 ` [PATCH v2 6/8] s390/sclp: add extended-length sccb support for kvm guest Collin Walling
2020-05-18 8:55 ` Janosch Frank
2020-05-18 14:31 ` Collin Walling
2020-05-25 10:50 ` Janosch Frank
2020-05-26 14:38 ` Collin Walling
2020-05-19 13:47 ` Cornelia Huck
2020-05-15 22:20 ` [PATCH v2 7/8] s390/kvm: header sync for diag318 Collin Walling
2020-05-15 22:20 ` [PATCH v2 8/8] s390: guest support for diagnose 0x318 Collin Walling
2020-05-20 11:30 ` Cornelia Huck
2020-05-21 6:18 ` Collin Walling
2020-05-16 6:41 ` [PATCH v2 0/8] s390: Extended-Length SCCB & DIAGNOSE 0x318 no-reply
2020-05-18 17:34 ` Collin Walling
2020-05-18 17:51 ` David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58bd2552-8cb9-5914-dbfd-a6a05ffdf396@linux.ibm.com \
--to=walling@linux.ibm.com \
--cc=borntraeger@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=david@redhat.com \
--cc=frankja@linux.ibm.com \
--cc=mihajlov@linux.ibm.com \
--cc=mst@redhat.com \
--cc=pasic@linux.ibm.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=rth@twiddle.net \
--cc=svens@linux.ibm.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).