|
 |
4ec855 |
From 07c499baed0c800e43cd6ec867fc465dea43567d Mon Sep 17 00:00:00 2001
|
|
|
4ec855 |
From: Markus Armbruster <armbru@redhat.com>
|
|
|
4ec855 |
Date: Mon, 7 Oct 2019 07:35:08 +0100
|
|
|
4ec855 |
Subject: [PATCH 15/22] fw_cfg: Fix -boot reboot-timeout error checking
|
|
|
4ec855 |
MIME-Version: 1.0
|
|
|
4ec855 |
Content-Type: text/plain; charset=UTF-8
|
|
|
4ec855 |
Content-Transfer-Encoding: 8bit
|
|
|
4ec855 |
|
|
|
4ec855 |
RH-Author: Markus Armbruster <armbru@redhat.com>
|
|
|
4ec855 |
Message-id: <20191007073509.5887-4-armbru@redhat.com>
|
|
|
4ec855 |
Patchwork-id: 90979
|
|
|
4ec855 |
O-Subject: [RHEL-8.2.0 qemu-kvm PATCH v2 3/4] fw_cfg: Fix -boot reboot-timeout error checking
|
|
|
4ec855 |
Bugzilla: 1607367
|
|
|
4ec855 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
4ec855 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
4ec855 |
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
4ec855 |
|
|
|
4ec855 |
From: Li Qiang <liq3ea@gmail.com>
|
|
|
4ec855 |
|
|
|
4ec855 |
fw_cfg_reboot() gets option parameter "reboot-timeout" with
|
|
|
4ec855 |
qemu_opt_get(), then converts it to an integer by hand. It neglects to
|
|
|
4ec855 |
check that conversion for errors, and fails to reject negative values.
|
|
|
4ec855 |
Positive values above the limit get reported and replaced by the limit.
|
|
|
4ec855 |
This patch checks for conversion errors properly, and reject all values
|
|
|
4ec855 |
outside 0...0xffff.
|
|
|
4ec855 |
|
|
|
4ec855 |
Signed-off-by: Li Qiang <liq3ea@gmail.com>
|
|
|
4ec855 |
Reviewed-by: Markus Armbruster <armbru@redhat.com>
|
|
|
4ec855 |
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
4ec855 |
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
4ec855 |
Message-Id: <1542777026-2788-3-git-send-email-liq3ea@gmail.com>
|
|
|
4ec855 |
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
4ec855 |
(cherry picked from commit ee5d0f89de3e53cdb0dcf51acc1502b310ed3bd2)
|
|
|
4ec855 |
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
|
4ec855 |
---
|
|
|
4ec855 |
hw/nvram/fw_cfg.c | 27 +++++++++++++--------------
|
|
|
4ec855 |
vl.c | 2 +-
|
|
|
4ec855 |
2 files changed, 14 insertions(+), 15 deletions(-)
|
|
|
4ec855 |
|
|
|
4ec855 |
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
|
|
|
4ec855 |
index d7185ea..02ab458 100644
|
|
|
4ec855 |
--- a/hw/nvram/fw_cfg.c
|
|
|
4ec855 |
+++ b/hw/nvram/fw_cfg.c
|
|
|
4ec855 |
@@ -176,26 +176,25 @@ static void fw_cfg_bootsplash(FWCfgState *s)
|
|
|
4ec855 |
|
|
|
4ec855 |
static void fw_cfg_reboot(FWCfgState *s)
|
|
|
4ec855 |
{
|
|
|
4ec855 |
- int reboot_timeout = -1;
|
|
|
4ec855 |
- char *p;
|
|
|
4ec855 |
- const char *temp;
|
|
|
4ec855 |
+ const char *reboot_timeout = NULL;
|
|
|
4ec855 |
+ int64_t rt_val = -1;
|
|
|
4ec855 |
|
|
|
4ec855 |
/* get user configuration */
|
|
|
4ec855 |
QemuOptsList *plist = qemu_find_opts("boot-opts");
|
|
|
4ec855 |
QemuOpts *opts = QTAILQ_FIRST(&plist->head);
|
|
|
4ec855 |
- if (opts != NULL) {
|
|
|
4ec855 |
- temp = qemu_opt_get(opts, "reboot-timeout");
|
|
|
4ec855 |
- if (temp != NULL) {
|
|
|
4ec855 |
- p = (char *)temp;
|
|
|
4ec855 |
- reboot_timeout = strtol(p, &p, 10);
|
|
|
4ec855 |
+ reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
|
|
|
4ec855 |
+
|
|
|
4ec855 |
+ if (reboot_timeout) {
|
|
|
4ec855 |
+ rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
|
|
|
4ec855 |
+ /* validate the input */
|
|
|
4ec855 |
+ if (rt_val < 0 || rt_val > 0xffff) {
|
|
|
4ec855 |
+ error_report("reboot timeout is invalid,"
|
|
|
4ec855 |
+ "it should be a value between 0 and 65535");
|
|
|
4ec855 |
+ exit(1);
|
|
|
4ec855 |
}
|
|
|
4ec855 |
}
|
|
|
4ec855 |
- /* validate the input */
|
|
|
4ec855 |
- if (reboot_timeout > 0xffff) {
|
|
|
4ec855 |
- error_report("reboot timeout is larger than 65535, force it to 65535.");
|
|
|
4ec855 |
- reboot_timeout = 0xffff;
|
|
|
4ec855 |
- }
|
|
|
4ec855 |
- fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4);
|
|
|
4ec855 |
+
|
|
|
4ec855 |
+ fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_val, 4), 4);
|
|
|
4ec855 |
}
|
|
|
4ec855 |
|
|
|
4ec855 |
static void fw_cfg_write(FWCfgState *s, uint8_t value)
|
|
|
4ec855 |
diff --git a/vl.c b/vl.c
|
|
|
4ec855 |
index e2212f5..3cee95f 100644
|
|
|
4ec855 |
--- a/vl.c
|
|
|
4ec855 |
+++ b/vl.c
|
|
|
4ec855 |
@@ -367,7 +367,7 @@ static QemuOptsList qemu_boot_opts = {
|
|
|
4ec855 |
.type = QEMU_OPT_NUMBER,
|
|
|
4ec855 |
}, {
|
|
|
4ec855 |
.name = "reboot-timeout",
|
|
|
4ec855 |
- .type = QEMU_OPT_STRING,
|
|
|
4ec855 |
+ .type = QEMU_OPT_NUMBER,
|
|
|
4ec855 |
}, {
|
|
|
4ec855 |
.name = "strict",
|
|
|
4ec855 |
.type = QEMU_OPT_BOOL,
|
|
|
4ec855 |
--
|
|
|
4ec855 |
1.8.3.1
|
|
|
4ec855 |
|