cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-fw_cfg-Fix-boot-reboot-timeout-error-checking.patch

Pablo Greco e6a3ae
From 07c499baed0c800e43cd6ec867fc465dea43567d Mon Sep 17 00:00:00 2001
Pablo Greco e6a3ae
From: Markus Armbruster <armbru@redhat.com>
Pablo Greco e6a3ae
Date: Mon, 7 Oct 2019 07:35:08 +0100
Pablo Greco e6a3ae
Subject: [PATCH 15/22] fw_cfg: Fix -boot reboot-timeout error checking
Pablo Greco e6a3ae
MIME-Version: 1.0
Pablo Greco e6a3ae
Content-Type: text/plain; charset=UTF-8
Pablo Greco e6a3ae
Content-Transfer-Encoding: 8bit
Pablo Greco e6a3ae
Pablo Greco e6a3ae
RH-Author: Markus Armbruster <armbru@redhat.com>
Pablo Greco e6a3ae
Message-id: <20191007073509.5887-4-armbru@redhat.com>
Pablo Greco e6a3ae
Patchwork-id: 90979
Pablo Greco e6a3ae
O-Subject: [RHEL-8.2.0 qemu-kvm PATCH v2 3/4] fw_cfg: Fix -boot reboot-timeout error checking
Pablo Greco e6a3ae
Bugzilla: 1607367
Pablo Greco e6a3ae
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
From: Li Qiang <liq3ea@gmail.com>
Pablo Greco e6a3ae
Pablo Greco e6a3ae
fw_cfg_reboot() gets option parameter "reboot-timeout" with
Pablo Greco e6a3ae
qemu_opt_get(), then converts it to an integer by hand. It neglects to
Pablo Greco e6a3ae
check that conversion for errors, and fails to reject negative values.
Pablo Greco e6a3ae
Positive values above the limit get reported and replaced by the limit.
Pablo Greco e6a3ae
This patch checks for conversion errors properly, and reject all values
Pablo Greco e6a3ae
outside 0...0xffff.
Pablo Greco e6a3ae
Pablo Greco e6a3ae
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Pablo Greco e6a3ae
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Pablo Greco e6a3ae
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Pablo Greco e6a3ae
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
Message-Id: <1542777026-2788-3-git-send-email-liq3ea@gmail.com>
Pablo Greco e6a3ae
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Pablo Greco e6a3ae
(cherry picked from commit ee5d0f89de3e53cdb0dcf51acc1502b310ed3bd2)
Pablo Greco e6a3ae
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
Pablo Greco e6a3ae
---
Pablo Greco e6a3ae
 hw/nvram/fw_cfg.c | 27 +++++++++++++--------------
Pablo Greco e6a3ae
 vl.c              |  2 +-
Pablo Greco e6a3ae
 2 files changed, 14 insertions(+), 15 deletions(-)
Pablo Greco e6a3ae
Pablo Greco e6a3ae
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
Pablo Greco e6a3ae
index d7185ea..02ab458 100644
Pablo Greco e6a3ae
--- a/hw/nvram/fw_cfg.c
Pablo Greco e6a3ae
+++ b/hw/nvram/fw_cfg.c
Pablo Greco e6a3ae
@@ -176,26 +176,25 @@ static void fw_cfg_bootsplash(FWCfgState *s)
Pablo Greco e6a3ae
 
Pablo Greco e6a3ae
 static void fw_cfg_reboot(FWCfgState *s)
Pablo Greco e6a3ae
 {
Pablo Greco e6a3ae
-    int reboot_timeout = -1;
Pablo Greco e6a3ae
-    char *p;
Pablo Greco e6a3ae
-    const char *temp;
Pablo Greco e6a3ae
+    const char *reboot_timeout = NULL;
Pablo Greco e6a3ae
+    int64_t rt_val = -1;
Pablo Greco e6a3ae
 
Pablo Greco e6a3ae
     /* get user configuration */
Pablo Greco e6a3ae
     QemuOptsList *plist = qemu_find_opts("boot-opts");
Pablo Greco e6a3ae
     QemuOpts *opts = QTAILQ_FIRST(&plist->head);
Pablo Greco e6a3ae
-    if (opts != NULL) {
Pablo Greco e6a3ae
-        temp = qemu_opt_get(opts, "reboot-timeout");
Pablo Greco e6a3ae
-        if (temp != NULL) {
Pablo Greco e6a3ae
-            p = (char *)temp;
Pablo Greco e6a3ae
-            reboot_timeout = strtol(p, &p, 10);
Pablo Greco e6a3ae
+    reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
Pablo Greco e6a3ae
+
Pablo Greco e6a3ae
+    if (reboot_timeout) {
Pablo Greco e6a3ae
+        rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
Pablo Greco e6a3ae
+        /* validate the input */
Pablo Greco e6a3ae
+        if (rt_val < 0 || rt_val > 0xffff) {
Pablo Greco e6a3ae
+            error_report("reboot timeout is invalid,"
Pablo Greco e6a3ae
+                         "it should be a value between 0 and 65535");
Pablo Greco e6a3ae
+            exit(1);
Pablo Greco e6a3ae
         }
Pablo Greco e6a3ae
     }
Pablo Greco e6a3ae
-    /* validate the input */
Pablo Greco e6a3ae
-    if (reboot_timeout > 0xffff) {
Pablo Greco e6a3ae
-        error_report("reboot timeout is larger than 65535, force it to 65535.");
Pablo Greco e6a3ae
-        reboot_timeout = 0xffff;
Pablo Greco e6a3ae
-    }
Pablo Greco e6a3ae
-    fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4);
Pablo Greco e6a3ae
+
Pablo Greco e6a3ae
+    fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_val, 4), 4);
Pablo Greco e6a3ae
 }
Pablo Greco e6a3ae
 
Pablo Greco e6a3ae
 static void fw_cfg_write(FWCfgState *s, uint8_t value)
Pablo Greco e6a3ae
diff --git a/vl.c b/vl.c
Pablo Greco e6a3ae
index e2212f5..3cee95f 100644
Pablo Greco e6a3ae
--- a/vl.c
Pablo Greco e6a3ae
+++ b/vl.c
Pablo Greco e6a3ae
@@ -367,7 +367,7 @@ static QemuOptsList qemu_boot_opts = {
Pablo Greco e6a3ae
             .type = QEMU_OPT_NUMBER,
Pablo Greco e6a3ae
         }, {
Pablo Greco e6a3ae
             .name = "reboot-timeout",
Pablo Greco e6a3ae
-            .type = QEMU_OPT_STRING,
Pablo Greco e6a3ae
+            .type = QEMU_OPT_NUMBER,
Pablo Greco e6a3ae
         }, {
Pablo Greco e6a3ae
             .name = "strict",
Pablo Greco e6a3ae
             .type = QEMU_OPT_BOOL,
Pablo Greco e6a3ae
-- 
Pablo Greco e6a3ae
1.8.3.1
Pablo Greco e6a3ae