cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-s390-sclp-check-sccb-len-before-filling-in-data.patch

c687bc
From 6cc7c8dd7a6fac493c648c607bec4c38c0b275b6 Mon Sep 17 00:00:00 2001
c687bc
From: Thomas Huth <thuth@redhat.com>
c687bc
Date: Wed, 11 Nov 2020 12:03:09 -0500
c687bc
Subject: [PATCH 09/18] s390/sclp: check sccb len before filling in data
c687bc
c687bc
RH-Author: Thomas Huth <thuth@redhat.com>
c687bc
Message-id: <20201111120316.707489-6-thuth@redhat.com>
c687bc
Patchwork-id: 99502
c687bc
O-Subject: [RHEL-8.4.0 qemu-kvm PATCH v2 05/12] s390/sclp: check sccb len before filling in data
c687bc
Bugzilla: 1798506
c687bc
RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
c687bc
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
c687bc
RH-Acked-by: David Hildenbrand <david@redhat.com>
c687bc
c687bc
From: Collin Walling <walling@linux.ibm.com>
c687bc
c687bc
The SCCB must be checked for a sufficient length before it is filled
c687bc
with any data. If the length is insufficient, then the SCLP command
c687bc
is suppressed and the proper response code is set in the SCCB header.
c687bc
c687bc
While we're at it, let's cleanup the length check by placing the
c687bc
calculation inside a macro.
c687bc
c687bc
Fixes: 832be0d8a3bb ("s390x: sclp: Report insufficient SCCB length")
c687bc
Signed-off-by: Collin Walling <walling@linux.ibm.com>
c687bc
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
c687bc
Reviewed-by: David Hildenbrand <david@redhat.com>
c687bc
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
c687bc
Reviewed-by: Thomas Huth <thuth@redhat.com>
c687bc
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
c687bc
Message-Id: <20200915194416.107460-5-walling@linux.ibm.com>
c687bc
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
c687bc
(cherry picked from commit 0260b97824495ebfacfa8bbae0be10b0ef986bf6)
c687bc
Signed-off-by: Thomas Huth <thuth@redhat.com>
c687bc
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
c687bc
---
c687bc
 hw/s390x/sclp.c | 26 ++++++++++++++------------
c687bc
 1 file changed, 14 insertions(+), 12 deletions(-)
c687bc
c687bc
diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
c687bc
index cf1292beb22..2b4c6c5cfad 100644
c687bc
--- a/hw/s390x/sclp.c
c687bc
+++ b/hw/s390x/sclp.c
c687bc
@@ -78,6 +78,8 @@ static void prepare_cpu_entries(MachineState *ms, CPUEntry *entry, int *count)
c687bc
     }
c687bc
 }
c687bc
 
c687bc
+#define SCCB_REQ_LEN(s, max_cpus) (sizeof(s) + max_cpus * sizeof(CPUEntry))
c687bc
+
c687bc
 /* Provide information about the configuration, CPUs and storage */
c687bc
 static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
c687bc
 {
c687bc
@@ -86,6 +88,12 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
c687bc
     int cpu_count;
c687bc
     int rnsize, rnmax;
c687bc
     IplParameterBlock *ipib = s390_ipl_get_iplb();
c687bc
+    int required_len = SCCB_REQ_LEN(ReadInfo, machine->possible_cpus->len);
c687bc
+
c687bc
+    if (be16_to_cpu(sccb->h.length) < required_len) {
c687bc
+        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
c687bc
+        return;
c687bc
+    }
c687bc
 
c687bc
     /* CPU information */
c687bc
     prepare_cpu_entries(machine, read_info->entries, &cpu_count);
c687bc
@@ -95,12 +103,6 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
c687bc
 
c687bc
     read_info->ibc_val = cpu_to_be32(s390_get_ibc_val());
c687bc
 
c687bc
-    if (be16_to_cpu(sccb->h.length) <
c687bc
-            (sizeof(ReadInfo) + cpu_count * sizeof(CPUEntry))) {
c687bc
-        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
c687bc
-        return;
c687bc
-    }
c687bc
-
c687bc
     /* Configuration Characteristic (Extension) */
c687bc
     s390_get_feat_block(S390_FEAT_TYPE_SCLP_CONF_CHAR,
c687bc
                          read_info->conf_char);
c687bc
@@ -146,18 +148,18 @@ static void sclp_read_cpu_info(SCLPDevice *sclp, SCCB *sccb)
c687bc
     MachineState *machine = MACHINE(qdev_get_machine());
c687bc
     ReadCpuInfo *cpu_info = (ReadCpuInfo *) sccb;
c687bc
     int cpu_count;
c687bc
+    int required_len = SCCB_REQ_LEN(ReadCpuInfo, machine->possible_cpus->len);
c687bc
+
c687bc
+    if (be16_to_cpu(sccb->h.length) < required_len) {
c687bc
+        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
c687bc
+        return;
c687bc
+    }
c687bc
 
c687bc
     prepare_cpu_entries(machine, cpu_info->entries, &cpu_count);
c687bc
     cpu_info->nr_configured = cpu_to_be16(cpu_count);
c687bc
     cpu_info->offset_configured = cpu_to_be16(offsetof(ReadCpuInfo, entries));
c687bc
     cpu_info->nr_standby = cpu_to_be16(0);
c687bc
 
c687bc
-    if (be16_to_cpu(sccb->h.length) <
c687bc
-            (sizeof(ReadCpuInfo) + cpu_count * sizeof(CPUEntry))) {
c687bc
-        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
c687bc
-        return;
c687bc
-    }
c687bc
-
c687bc
     /* The standby offset is 16-byte for each CPU */
c687bc
     cpu_info->offset_standby = cpu_to_be16(cpu_info->offset_configured
c687bc
         + cpu_info->nr_configured*sizeof(CPUEntry));
c687bc
-- 
c687bc
2.27.0
c687bc