| Message ID | 20150630120431.11866.32507.stgit@bahia.lab.toulouse-stg.fr.ibm.com |
|---|---|
| State | New |
| Headers | show |
On Tue, 30 Jun 2015 14:04:31 +0200 Greg Kurz <gkurz@linux.vnet.ibm.com> wrote: > If a guest passes the reg property of a valid VIO object that is not a VTY > to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast > assertion and aborts. > > PAPR+ says "Hypervisor checks the termno parameter for validity against the > Vterm IOA unit addresses assigned to the partition, else return H_Parameter." > > This patch adds a type check to ensure vty_lookup() either returns a pointer > to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will > now return H_PARAMETER to the guest instead of crashing. > > The patch has no effect on the reg == 0 hack used to implement the RTAS call > display-character. > > Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> > --- Oops I forgot to Cc: the QEMU PPC mailing list... > hw/char/spapr_vty.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c > index 4e464bd15a54..7eeacde31d27 100644 > --- a/hw/char/spapr_vty.c > +++ b/hw/char/spapr_vty.c > @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg) > return spapr_vty_get_default(spapr->vio_bus); > } > > - return sdev; > + return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE); > } > > static void spapr_vty_register_types(void) > >
On Tue, Jun 30, 2015 at 02:04:31PM +0200, Greg Kurz wrote: > If a guest passes the reg property of a valid VIO object that is not a VTY > to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast > assertion and aborts. > > PAPR+ says "Hypervisor checks the termno parameter for validity against the > Vterm IOA unit addresses assigned to the partition, else return H_Parameter." > > This patch adds a type check to ensure vty_lookup() either returns a pointer > to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will > now return H_PARAMETER to the guest instead of crashing. > > The patch has no effect on the reg == 0 hack used to implement the RTAS call > display-character. > > Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Ouch. That's a nasty bug that's been in there for a long time. I've applied this to spapr-next. We should also push to the stable branch. > --- > hw/char/spapr_vty.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c > index 4e464bd15a54..7eeacde31d27 100644 > --- a/hw/char/spapr_vty.c > +++ b/hw/char/spapr_vty.c > @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg) > return spapr_vty_get_default(spapr->vio_bus); > } > > - return sdev; > + return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE); > } > > static void spapr_vty_register_types(void) >
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c index 4e464bd15a54..7eeacde31d27 100644 --- a/hw/char/spapr_vty.c +++ b/hw/char/spapr_vty.c @@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg) return spapr_vty_get_default(spapr->vio_bus); } - return sdev; + return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE); } static void spapr_vty_register_types(void)
If a guest passes the reg property of a valid VIO object that is not a VTY to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast assertion and aborts. PAPR+ says "Hypervisor checks the termno parameter for validity against the Vterm IOA unit addresses assigned to the partition, else return H_Parameter." This patch adds a type check to ensure vty_lookup() either returns a pointer to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will now return H_PARAMETER to the guest instead of crashing. The patch has no effect on the reg == 0 hack used to implement the RTAS call display-character. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> --- hw/char/spapr_vty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)