[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-ppc] [PATCH] spapr_vty: lookup should only return valid VTY object

From: David Gibson
Subject: [Qemu-ppc] [PATCH] spapr_vty: lookup should only return valid VTY objects
Date: Wed, 1 Jul 2015 13:51:43 +1000

From: Greg Kurz <address@hidden>

If a guest passes the reg property of a valid VIO object that is not a VTY
to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
assertion and aborts.

PAPR+ says "Hypervisor checks the termno parameter for validity against the
Vterm IOA unit addresses assigned to the partition, else return H_Parameter."

This patch adds a type check to ensure vty_lookup() either returns a pointer
to a valid VTY object or NULL.  H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
now return H_PARAMETER to the guest instead of crashing.

The patch has no effect on the reg == 0 hack used to implement the RTAS call

Signed-off-by: Greg Kurz <address@hidden>
Signed-off-by: David Gibson <address@hidden>
 hw/char/spapr_vty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

I've already merged this into spapr-next and it will be in the next
batch I send if not merged before that.

But I think this is an important enough fix (it allows the guest to
crash qemu) that it should probably be fastracked into mainline and

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1d53035..f407cd0 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -228,7 +228,7 @@ VIOsPAPRDevice *vty_lookup(sPAPRMachineState *spapr, 
target_ulong reg)
         return spapr_vty_get_default(spapr->vio_bus);
-    return sdev;
+    return object_dynamic_cast(sdev, TYPE_VIO_SPAPR_VTY_DEVICE);
 static void spapr_vty_register_types(void)

reply via email to

[Prev in Thread] Current Thread [Next in Thread]