[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 03/19] s390/sclp: rework sclp boundary checks
From: |
Cornelia Huck |
Subject: |
[PULL 03/19] s390/sclp: rework sclp boundary checks |
Date: |
Fri, 2 Oct 2020 14:11:02 +0200 |
From: Collin Walling <walling@linux.ibm.com>
Rework the SCLP boundary check to account for different SCLP commands
(eventually) allowing different boundary sizes.
Signed-off-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-Id: <20200915194416.107460-3-walling@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
hw/s390x/sclp.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 28b973de8fd2..a37cfbf534cd 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -49,6 +49,18 @@ static inline bool sclp_command_code_valid(uint32_t code)
return false;
}
+static bool sccb_verify_boundary(uint64_t sccb_addr, uint16_t sccb_len)
+{
+ uint64_t sccb_max_addr = sccb_addr + sccb_len - 1;
+ uint64_t sccb_boundary = (sccb_addr & PAGE_MASK) + PAGE_SIZE;
+
+ if (sccb_max_addr < sccb_boundary) {
+ return true;
+ }
+
+ return false;
+}
+
static void prepare_cpu_entries(MachineState *ms, CPUEntry *entry, int *count)
{
uint8_t features[SCCB_CPU_FEATURE_LEN] = { 0 };
@@ -229,6 +241,11 @@ int sclp_service_call_protected(CPUS390XState *env,
uint64_t sccb,
goto out_write;
}
+ if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) {
+ work_sccb.h.response_code =
cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
+ goto out_write;
+ }
+
sclp_c->execute(sclp, &work_sccb, code);
out_write:
s390_cpu_pv_mem_write(env_archcpu(env), 0, &work_sccb,
@@ -274,7 +291,7 @@ int sclp_service_call(CPUS390XState *env, uint64_t sccb,
uint32_t code)
goto out_write;
}
- if ((sccb + be16_to_cpu(work_sccb.h.length)) > ((sccb & PAGE_MASK) +
PAGE_SIZE)) {
+ if (!sccb_verify_boundary(sccb, be16_to_cpu(work_sccb.h.length))) {
work_sccb.h.response_code =
cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION);
goto out_write;
}
--
2.25.4
- [PULL 00/19] s390x changes, Cornelia Huck, 2020/10/02
- [PULL 01/19] hw/s390x/css: Remove double initialization, Cornelia Huck, 2020/10/02
- [PULL 02/19] s390/sclp: get machine once during read scp/cpu info, Cornelia Huck, 2020/10/02
- [PULL 04/19] s390/sclp: read sccb from mem based on provided length, Cornelia Huck, 2020/10/02
- [PULL 07/19] s390/sclp: add extended-length sccb support for kvm guest, Cornelia Huck, 2020/10/02
- [PULL 03/19] s390/sclp: rework sclp boundary checks,
Cornelia Huck <=
- [PULL 05/19] s390/sclp: check sccb len before filling in data, Cornelia Huck, 2020/10/02
- [PULL 08/19] s390: guest support for diagnose 0x318, Cornelia Huck, 2020/10/02
- [PULL 06/19] s390/sclp: use cpu offset to locate cpu entries, Cornelia Huck, 2020/10/02
- [PULL 09/19] s390x/tcg: Implement MONITOR CALL, Cornelia Huck, 2020/10/02
- [PULL 10/19] vfio-ccw: plug memory leak while getting region info, Cornelia Huck, 2020/10/02
- [PULL 13/19] s390x/tcg: Implement SUBTRACT HALFWORD (SGH), Cornelia Huck, 2020/10/02
- [PULL 11/19] s390x/cpumodel: S390_FEAT_MISC_INSTRUCTION_EXT -> S390_FEAT_MISC_INSTRUCTION_EXT2, Cornelia Huck, 2020/10/02
- [PULL 12/19] s390x/tcg: Implement ADD HALFWORD (AGH), Cornelia Huck, 2020/10/02
- [PULL 14/19] s390x/tcg: Implement MULTIPLY (MG, MGRK), Cornelia Huck, 2020/10/02
- [PULL 15/19] s390x/tcg: Implement MULTIPLY HALFWORD (MGH), Cornelia Huck, 2020/10/02