diff options
| author | Greg Kurz <groug@kaod.org> | 2017-10-04 11:02:31 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2017-10-17 10:34:00 +1100 |
| commit | 827b17c468b0dae69f82f852958d16f4bf6d6bf0 (patch) | |
| tree | 8ec767ad79cd15c27962b8523b3aeafaa5ec5f46 /hw/ppc/spapr.c | |
| parent | dc1b5eee868d0ce18dd83e472cdd282257fe6938 (diff) | |
| download | qemu-827b17c468b0dae69f82f852958d16f4bf6d6bf0.zip | |
spapr: sanity check size of the CAS buffer
The CAS buffer is provided by SLOF. A broken SLOF could pass a silly
size: either smaller than the diff header, in which case the current
code will try to allocate 16 Exabytes of memory and g_malloc0() will
abort, or bigger than the maximum memory provisioned for SLOF (ie,
40 Megabytes), which doesn't make sense. Both cases indicate that
SLOF has a bug.
Let's print out an explicit error message and exit since rebooting as
we do with other errors would only result in a reset loop.
Signed-off-by: Greg Kurz <groug@kaod.org>
[dwg: Fix format specifier that broke 32-bit builds]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw/ppc/spapr.c')
| -rw-r--r-- | hw/ppc/spapr.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index b284e0b9d4..079e493ef4 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -819,6 +819,13 @@ int spapr_h_cas_compose_response(sPAPRMachineState *spapr, return 1; } + if (size < sizeof(hdr) || size > FW_MAX_SIZE) { + error_report("SLOF provided an unexpected CAS buffer size " + TARGET_FMT_lu " (min: %zu, max: %u)", + size, sizeof(hdr), FW_MAX_SIZE); + exit(EXIT_FAILURE); + } + size -= sizeof(hdr); /* Create skeleton */ |