summaryrefslogtreecommitdiff
path: root/stubs
diff options
context:
space:
mode:
authorDavid Gibson <david@gibson.dropbear.id.au>2015-07-02 16:23:24 +1000
committerMichael Roth <mdroth@linux.vnet.ibm.com>2015-07-29 21:48:27 -0500
commit9b4420ad624905860deda56b5901276d695dad9c (patch)
treeeb577234bc83ace9c1de68f37d99ce75cda7e9e4 /stubs
parent99c3468d8fedac2bf8098fc4e9f050cbd62ab912 (diff)
downloadqemu-9b4420ad624905860deda56b5901276d695dad9c.tar.gz
spapr_vty: lookup should only return valid VTY objects
If a guest passes the reg property of a valid VIO object that is not a VTY to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast assertion and aborts. PAPR+ says "Hypervisor checks the termno parameter for validity against the Vterm IOA unit addresses assigned to the partition, else return H_Parameter." This patch adds a type check to ensure vty_lookup() either returns a pointer to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will now return H_PARAMETER to the guest instead of crashing. The patch has no effect on the reg == 0 hack used to implement the RTAS call display-character. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 0f888bfaddfc5f55b0d82cde2e1164658a672375) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'stubs')
0 files changed, 0 insertions, 0 deletions