If a guest passes the reg property of a valid VIO object that is not a VTY
to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast
assertion and aborts.
PAPR+ says "Hypervisor checks the termno parameter for validity against the
Vterm IOA unit addresses assigned to the partition, else return H_Parameter."
This patch adds a type check to ensure vty_lookup() either returns a pointer
to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will
now return H_PARAMETER to the guest instead of crashing.
The patch has no effect on the reg == 0 hack used to implement the RTAS call
display-character.
Signed-off-by: Greg Kurz <gk...@linux.vnet.ibm.com>
Signed-off-by: David Gibson <da...@gibson.dropbear.id.au>
---
hw/char/spapr_vty.c | 4 ++++
1 file changed, 4 insertions(+)
I've already merged this into spapr-next and it will be in the next
batch I send if not merged before that.
But I think this is an important enough fix (it allows the guest to
crash qemu) that it should probably be fastracked into mainline and
stable.
Changes in v2:
* Fixed type errors in invocation of object_dynamic_cast()
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1d53035..2d532af 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -228,6 +228,10 @@ VIOsPAPRDevice *vty_lookup(sPAPRMachineState *spapr,
target_ulong reg)
return spapr_vty_get_default(spapr->vio_bus);
}
+ if (!object_dynamic_cast(OBJECT(sdev), TYPE_VIO_SPAPR_VTY_DEVICE)) {
+ return NULL;
+ }
+
return sdev;
}
--
2.4.3
