Add a sanity checks to fix the following two crashes: $ echo "Insane in the mainframe" > /tmp/test.txt $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz Segmentation fault (core dumped) $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt Segmentation fault (core dumped)
Signed-off-by: Thomas Huth <[email protected]> --- v2: Fixed 2nd crash with -initrd hw/s390x/ipl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 04245b5..2ff8f20 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -168,7 +168,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp) * we can not rely on the ELF entry point - it was 0x800 (the SALIPL * loader) and it won't work. For this case we force it to 0x10000, too. */ - if (pentry == KERN_IMAGE_START || pentry == 0x800) { + if ((pentry == KERN_IMAGE_START || pentry == 0x800) && + kernel_size > KERN_PARM_AREA + strlen(ipl->cmdline)) { ipl->start_addr = KERN_IMAGE_START; /* Overwrite parameters in the kernel image, which are "rom" */ strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline); @@ -195,8 +196,10 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp) * we have to overwrite values in the kernel image, * which are "rom" */ - stq_p(rom_ptr(INITRD_PARM_START), initrd_offset); - stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size); + if (kernel_size > INITRD_PARM_SIZE + 8) { + stq_p(rom_ptr(INITRD_PARM_START), initrd_offset); + stq_p(rom_ptr(INITRD_PARM_SIZE), initrd_size); + } } } /* -- 1.8.3.1
