haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
qemu-patch-raspberry4/hw
History
Thomas Huth 0f0f8b611e loader: Check access size when calling rom_ptr() to avoid crashes 
The rom_ptr() function allows direct access to the ROM blobs that we
load during startup. However, there are currently no checks for the
size of the accesses, so it's currently possible to crash QEMU for
example with:

$ echo "Insane in the mainframe" > /tmp/test.txt
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz
Segmentation fault (core dumped)
$ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt
Segmentation fault (core dumped)
$ echo -n HdrS > /tmp/hdr.txt
$ sparc64-softmmu/qemu-system-sparc64 -kernel /tmp/hdr.txt -initrd /tmp/hdr.txt
Segmentation fault (core dumped)

We need a possibility to check the size of the ROM area that we want
to access, thus let's add a size parameter to the rom_ptr() function
to avoid these problems.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1530005740-25254-1-git-send-email-thuth@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-07-02 10:37:38 +02:00
..
9pfs 9p: darwin: Explicitly cast comparisons of mode_t with -1 2018-06-29 12:32:10 +02:00
acpi nvdimm: make persistence option symbolic 2018-06-11 22:19:57 +03:00
adc Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
alpha iommu: Add IOMMU index argument to translate method 2018-06-15 15:23:34 +01:00
arm i.mx7d: Change IRQ number type from hwaddr to int 2018-06-29 15:11:17 +01:00
audio audio/hda: enable new timer code by default. 2018-06-25 13:57:57 +02:00
block Pull request 2018-06-30 13:59:53 +01:00
bt hw/bt: Replace fprintf(stderr, "*\n" with error_report() 2018-01-22 09:51:00 +01:00
char Pull request 2018-06-30 13:59:53 +01:00
core loader: Check access size when calling rom_ptr() to avoid crashes 2018-07-02 10:37:38 +02:00
cpu hw: use "qemu/osdep.h" as first #include in source files 2017-12-18 17:07:02 +03:00
cris hw: Do not include "sysemu/block-backend.h" if it is not necessary 2018-06-01 14:15:10 +02:00
display compiler: add a sizeof_field() macro 2018-06-27 13:01:40 +01:00
dma hw/dma/omap_dma: Use qemu_log_mask(GUEST_ERROR) instead of fprintf 2018-06-26 17:50:40 +01:00
gpio hw/i2c: Use DeviceClass::realize instead of I2CSlaveClass::init 2018-06-01 15:14:31 +02:00
hppa acpi, vhost, misc: fixes, features 2018-06-04 10:15:16 +01:00
i2c hw/i2c/omap_i2c: Use qemu_log_mask(UNIMP) instead of fprintf 2018-06-26 17:50:40 +01:00
i386 hmp: obsolete "info ioapic" 2018-06-28 19:05:37 +02:00
ide ahci: fix FIS I bit and PIO Setup FIS interrupt 2018-06-25 16:50:48 -04:00
input hw/input/tsc2005: Convert a fprintf() call to trace events 2018-06-29 15:04:18 +01:00
intc hmp: obsolete "info ioapic" 2018-06-28 19:05:37 +02:00
ipack pci: Add INTERFACE_CONVENTIONAL_PCI_DEVICE to Conventional PCI devices 2017-10-15 05:54:43 +03:00
ipmi object: fix OBJ_PROP_LINK_UNREF_ON_RELEASE ambivalence 2018-06-12 12:07:30 +02:00
isa hw/isa/smc37c669: Change the parallel I/O base to 378H 2018-06-16 19:46:54 -10:00
lm32 hw: Do not include "sysemu/block-backend.h" if it is not necessary 2018-06-01 14:15:10 +02:00
m68k hw/m68k/mcf5206: Convert away from old_mmio 2018-06-15 15:23:34 +01:00
mem pc-dimm: get_memory_region() will not fail after realize 2018-06-28 19:05:34 +02:00
microblaze hw: Do not include "sysemu/block-backend.h" if it is not necessary 2018-06-01 14:15:10 +02:00
mips loader: Check access size when calling rom_ptr() to avoid crashes 2018-07-02 10:37:38 +02:00
misc hostmem: drop error variable from host_memory_backend_get_memory() 2018-06-28 19:05:33 +02:00
moxie Change references to serial_hds[] to serial_hd() 2018-04-26 13:57:00 +01:00
net hw/net/etraxfs_eth: Convert printf() calls to trace events 2018-06-29 15:04:18 +01:00
nios2 Change references to serial_hds[] to serial_hd() 2018-04-26 13:57:00 +01:00
nvram * Linux header upgrade (Peter) 2018-06-01 18:24:16 +01:00
openrisc Change references to serial_hds[] to serial_hd() 2018-04-26 13:57:00 +01:00
pci virtio,vhost,pci,pc: features, cleanups 2018-03-20 15:48:34 +00:00
pci-bridge virtio,vhost,pci,pc: features, fixes and cleanups 2018-02-13 16:33:31 +00:00
pci-host hw/pci-host/xilinx-pcie: don't make "io" region be RAM 2018-06-27 20:12:34 +02:00
pcmcia hw: Clean up includes 2016-01-29 15:07:25 +00:00
ppc pc-dimm: get_memory_region() will not fail after realize 2018-06-28 19:05:34 +02:00
rdma hw/rdma: Fix possible out of bounds access to port GID index 2018-05-03 20:52:29 +03:00
riscv hw: Do not include "exec/address-spaces.h" if it is not necessary 2018-06-01 14:15:10 +02:00
s390x loader: Check access size when calling rom_ptr() to avoid crashes 2018-07-02 10:37:38 +02:00
scsi Block layer patches: 2018-06-29 18:29:15 +01:00
sd Pull request 2018-06-30 13:59:53 +01:00
sh4 hw/sh/sh7750: Convert away from old_mmio 2018-06-15 15:23:34 +01:00
smbios Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
sparc loader: Check access size when calling rom_ptr() to avoid crashes 2018-07-02 10:37:38 +02:00
sparc64 loader: Check access size when calling rom_ptr() to avoid crashes 2018-07-02 10:37:38 +02:00
ssi hw/ssi/omap_spi: Use qemu_log_mask(GUEST_ERROR) instead of fprintf 2018-06-26 17:50:40 +01:00
timer aspeed/timer: use the APB frequency from the SCU 2018-06-26 17:50:42 +01:00
tpm tpm: extend TPM TIS with state migration support 2018-05-24 12:07:04 -04:00
tricore hw: Do not include "sysemu/block-backend.h" if it is not necessary 2018-03-12 16:12:46 +01:00
unicore32 hw/input/i8042: Extract declarations from i386/pc.h into input/i8042.h 2018-03-12 16:12:48 +01:00
usb usb-storage: Add rerror/werror properties 2018-06-29 14:20:56 +02:00
vfio vfio-ccw: add force unlimited prefetch property 2018-06-18 10:50:32 +02:00
virtio iommu: Add IOMMU index argument to notifier APIs 2018-06-15 15:23:34 +01:00
watchdog hw/watchdog/wdt_i6300esb: Convert away from old_mmio 2018-06-15 15:23:34 +01:00
xen xen: Don't use memory_region_init_ram_nomigrate() in pci_assign_dev_load_option_rom() 2018-06-22 13:28:42 +01:00
xenpv hw/xen*: Replace fprintf(stderr, "*\n" with error_report() 2018-02-06 18:29:46 +01:00
xtensa hw: Do not include "sysemu/block-backend.h" if it is not necessary 2018-06-01 14:15:10 +02:00
Makefile.objs hw: allow compiling out SCSI 2018-06-01 15:14:31 +02:00