diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2015-07-02 16:23:24 +1000 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2015-07-07 17:44:53 +0200 |
| commit | 0f888bfaddfc5f55b0d82cde2e1164658a672375 (patch) | |
| tree | 50db834ba86306fb8fab00fdc8eca8d1ad66c4e3 /hw | |
| parent | e634b89c6ed2309814de7a89bd7c5ced96f59291 (diff) | |
spapr_vty: lookup should only return valid VTY objects
If a guest passes the reg property of a valid VIO object that is not a VTY
to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
assertion and aborts.
PAPR+ says "Hypervisor checks the termno parameter for validity against the
Vterm IOA unit addresses assigned to the partition, else return H_Parameter."
This patch adds a type check to ensure vty_lookup() either returns a pointer
to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
now return H_PARAMETER to the guest instead of crashing.
The patch has no effect on the reg == 0 hack used to implement the RTAS call
display-character.
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/char/spapr_vty.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c index 1d53035cbe..2d532afc55 100644 --- a/hw/char/spapr_vty.c +++ b/hw/char/spapr_vty.c @@ -228,6 +228,10 @@ VIOsPAPRDevice *vty_lookup(sPAPRMachineState *spapr, target_ulong reg) return spapr_vty_get_default(spapr->vio_bus); } + if (!object_dynamic_cast(OBJECT(sdev), TYPE_VIO_SPAPR_VTY_DEVICE)) { + return NULL; + } + return sdev; } |