diff options
| author | Marc Hartmayer <mhartmay@linux.ibm.com> | 2021-10-06 11:26:30 +0200 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2021-10-13 16:20:55 +0200 |
| commit | f1420101023c7d170d802efc8daab686189ed1bf (patch) | |
| tree | f5523db7b4fdea92fe6711e3037158fbd34cf7a3 /hw/s390x | |
| parent | bfd9a76f9c143d450ab5545dedfa74364b39fc56 (diff) | |
| download | qemu-f1420101023c7d170d802efc8daab686189ed1bf.zip qemu-f1420101023c7d170d802efc8daab686189ed1bf.tar.gz qemu-f1420101023c7d170d802efc8daab686189ed1bf.tar.bz2 | |
s390x/ipl: check kernel command line size
Check if the provided kernel command line exceeds the maximum size of the s390x
Linux kernel command line size, which is 896 bytes.
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Message-Id: <20211006092631.20732-1-mhartmay@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
[thuth: Adjusted format specifier for size_t]
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'hw/s390x')
| -rw-r--r-- | hw/s390x/ipl.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 1821c6f..7ddca01 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -38,6 +38,7 @@ #define KERN_IMAGE_START 0x010000UL #define LINUX_MAGIC_ADDR 0x010008UL #define KERN_PARM_AREA 0x010480UL +#define KERN_PARM_AREA_SIZE 0x000380UL #define INITRD_START 0x800000UL #define INITRD_PARM_START 0x010408UL #define PARMFILE_START 0x001000UL @@ -190,10 +191,19 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp) * loader) and it won't work. For this case we force it to 0x10000, too. */ if (pentry == KERN_IMAGE_START || pentry == 0x800) { - char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1); + size_t cmdline_size = strlen(ipl->cmdline) + 1; + char *parm_area = rom_ptr(KERN_PARM_AREA, cmdline_size); + ipl->start_addr = KERN_IMAGE_START; /* Overwrite parameters in the kernel image, which are "rom" */ if (parm_area) { + if (cmdline_size > KERN_PARM_AREA_SIZE) { + error_setg(errp, + "kernel command line exceeds maximum size: %zu > %lu", + cmdline_size, KERN_PARM_AREA_SIZE); + return; + } + strcpy(parm_area, ipl->cmdline); } } else { |