Description of problem: `-prom-env` takes raw strings from the command-line and passes them through unvalidated into the NVRAM. It's possible to cause QEMU to abort by passing it malformed input. ``` ppc64-softmmu/qemu-system-ppc64 $(for ((x=0;x<128;x++)); do \ echo -n " -prom-env "$(for ((y=0;y<1024;y++)); do echo -n x ; done) ; \ done) free(): invalid next size (normal) Aborted (core dumped) ``` Version-Release number of selected component (if applicable): Observed upstream as of 5.1-rc4. Expected results: QEMU performs some light validation of either the user's input such that QEMU does not crash. (What the guest does is another story.)
Thomas doesn't really work on ppc64 any more, taking this one for the POWER team instead.
The crash happens in memcpy() because nvram->buf is allocated with the default size of 64 * KiB but the total size of all the -prom-env is 128 * KiB. It seems that spapr_nvram_realize() should take the -prom-env options into account when computing the size needed for the NVRAM. I already have a tentative patch FWIW.
Posted some patches: http://patchwork.ozlabs.org/project/qemu-devel/list/?series=195072
Reproduced similar issue on the following builds qemu-kvm-5.1.0-2.module+el8.3.0+7652+b30e6901.ppc64le /usr/libexec/qemu-kvm $(for ((x=0;x<128;x++)); do \ > echo -n " -prom-env "$(for ((y=0;y<1024;y++)); do echo -n x ; done) ; \ > done) malloc(): corrupted top size Aborted (core dumped)
Final fix merged upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=37035df51eaabb8d26b71da75b88a1c6727de8fa
Verified the bug on the following build kernel-4.18.0-236.el8.ppc64le qemu-kvm-5.1.0-6.module+el8.3.0+8041+42ff16b8.ppc64le Step please refer to comment 4, Actual results, qemu-kvm worked well, no core dump issue. Expected results, no core dump issue any more. So the issue has been fixed, move this bug to be verified, thanks.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (virt:8.3 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:5137